{"ts": "2026-09-14T07:58:01Z", "host": "EWS-07", "event": "process_start", "pid": 412, "ppid": 4, "image": "C:\\Windows\\System32\\smss.exe", "cmdline": "\\SystemRoot\\System32\\smss.exe", "user": "NT AUTHORITY\\SYSTEM", "sha256": "5e7de8993ba6937fc14cf87bf4b426b2ffdd23c71cb5b5893be1eda1915cf64a"}
{"ts": "2026-09-14T07:58:03Z", "host": "EWS-07", "event": "process_start", "pid": 560, "ppid": 412, "image": "C:\\Windows\\System32\\wininit.exe", "cmdline": "wininit.exe", "user": "NT AUTHORITY\\SYSTEM", "sha256": "c31cda8f1658e1679984f22638be5fce5a962c4f6eb2cbbd1f21024671447f52"}
{"ts": "2026-09-14T07:58:04Z", "host": "EWS-07", "event": "process_start", "pid": 712, "ppid": 560, "image": "C:\\Windows\\System32\\services.exe", "cmdline": "C:\\Windows\\system32\\services.exe", "user": "NT AUTHORITY\\SYSTEM", "sha256": "99dda1d5a35da11935464d3b49a27a12f5b5438612a90eb15276c686595d6474"}
{"ts": "2026-09-14T07:58:06Z", "host": "EWS-07", "event": "process_start", "pid": 1088, "ppid": 712, "image": "C:\\Windows\\System32\\svchost.exe", "cmdline": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p", "user": "NT AUTHORITY\\SYSTEM", "sha256": "d11db4421ce8acce60c80d3ac37443e8417a348f3159f796e39c4ecfb85a6a62"}
{"ts": "2026-09-14T07:58:07Z", "host": "EWS-07", "event": "process_start", "pid": 6292, "ppid": 712, "image": "C:\\Windows\\System32\\svchost.exe", "cmdline": "C:\\Windows\\system32\\svchost.exe -k RPCSS -p", "user": "NT AUTHORITY\\SYSTEM", "sha256": "d11db4421ce8acce60c80d3ac37443e8417a348f3159f796e39c4ecfb85a6a62"}
{"ts": "2026-09-14T07:58:08Z", "host": "EWS-07", "event": "process_start", "pid": 9232, "ppid": 712, "image": "C:\\Windows\\System32\\svchost.exe", "cmdline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p", "user": "NT AUTHORITY\\SYSTEM", "sha256": "d11db4421ce8acce60c80d3ac37443e8417a348f3159f796e39c4ecfb85a6a62"}
{"ts": "2026-09-14T07:58:09Z", "host": "EWS-07", "event": "process_start", "pid": 9536, "ppid": 712, "image": "C:\\Windows\\System32\\svchost.exe", "cmdline": "C:\\Windows\\system32\\svchost.exe -k LocalService -p", "user": "NT AUTHORITY\\SYSTEM", "sha256": "d11db4421ce8acce60c80d3ac37443e8417a348f3159f796e39c4ecfb85a6a62"}
{"ts": "2026-09-14T07:58:10Z", "host": "EWS-07", "event": "process_start", "pid": 8396, "ppid": 712, "image": "C:\\Windows\\System32\\svchost.exe", "cmdline": "C:\\Windows\\system32\\svchost.exe -k NetworkService -p", "user": "NT AUTHORITY\\SYSTEM", "sha256": "d11db4421ce8acce60c80d3ac37443e8417a348f3159f796e39c4ecfb85a6a62"}
{"ts": "2026-09-14T07:58:11Z", "host": "EWS-07", "event": "process_start", "pid": 828, "ppid": 712, "image": "C:\\Windows\\System32\\svchost.exe", "cmdline": "C:\\Windows\\system32\\svchost.exe -k Schedule -p", "user": "NT AUTHORITY\\SYSTEM", "sha256": "d11db4421ce8acce60c80d3ac37443e8417a348f3159f796e39c4ecfb85a6a62"}
{"ts": "2026-09-14T07:58:20Z", "host": "EWS-07", "event": "process_start", "pid": 9092, "ppid": 712, "image": "C:\\Program Files\\NightOwl Backup\\nobackup.exe", "cmdline": "\"C:\\Program Files\\NightOwl Backup\\nobackup.exe\" --service --profile bmlnaHRseQ==", "user": "NT AUTHORITY\\SYSTEM", "sha256": "4cbda533c2a67a87152a0e0295dcb4615520c621c80c2de335427b4d78ef3ba0"}
{"ts": "2026-09-14T08:01:12Z", "host": "EWS-07", "event": "process_start", "pid": 1840, "ppid": 9440, "image": "C:\\Windows\\explorer.exe", "cmdline": "C:\\Windows\\Explorer.EXE", "user": "PLANT\\eng.rmoss", "sha256": "592fe6a8046ce02e2460ee250d558ca582a215d9d214a4f4af04686483da07fc"}
{"ts": "2026-09-14T08:01:30Z", "host": "EWS-07", "event": "process_start", "pid": 2276, "ppid": 1840, "image": "C:\\Program Files\\AquaWorks\\Common\\aqualog.exe", "cmdline": "\"C:\\Program Files\\AquaWorks\\Common\\aqualog.exe\" --rotate daily --tag cGxhbnQtYQ==", "user": "PLANT\\eng.rmoss", "sha256": "1c9bce461ef8a17b29ec88f6dd955db50962fa964de448ef74df11c1901faa0c"}
{"ts": "2026-09-14T08:01:34Z", "host": "EWS-07", "event": "process_start", "pid": 2104, "ppid": 1840, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "cmdline": "\"C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe\" /project \"C:\\Projects\\PlantA\\PlantA.hmi\"", "user": "PLANT\\eng.rmoss", "sha256": "c00f41a020501711e59d688b51071a1ee572eedd250ac447e4d92acd4287bac6"}
{"ts": "2026-09-14T08:02:35Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T08:02:38Z", "host": "EWS-07", "event": "file_write", "pid": 2276, "image": "C:\\Program Files\\AquaWorks\\Common\\aqualog.exe", "path": "C:\\ProgramData\\AquaWorks\\Logs\\aqualog-20260914.log"}
{"ts": "2026-09-14T08:06:07Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T08:10:02Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T08:13:17Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T08:16:38Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T08:20:41Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T08:24:45Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T08:25:00Z", "host": "EWS-07", "event": "process_start", "pid": 7216, "ppid": 1840, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "cmdline": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=renderer --lang=en-US", "user": "PLANT\\eng.rmoss", "sha256": "b325a6fabe9a6b3069324026e588e3b6d25a11fbea19d254ec2e322d9a16dacf"}
{"ts": "2026-09-14T08:25:02Z", "host": "EWS-07", "event": "net_connect", "pid": 7216, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "dst_ip": "198.51.100.243", "dst_port": 443, "proto": "tcp"}
{"ts": "2026-09-14T08:28:28Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T08:33:25Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T08:38:17Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T08:42:06Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T08:43:00Z", "host": "EWS-07", "event": "process_start", "pid": 4924, "ppid": 1840, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "cmdline": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=renderer --lang=en-US", "user": "PLANT\\eng.rmoss", "sha256": "b325a6fabe9a6b3069324026e588e3b6d25a11fbea19d254ec2e322d9a16dacf"}
{"ts": "2026-09-14T08:43:02Z", "host": "EWS-07", "event": "net_connect", "pid": 4924, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "dst_ip": "198.51.100.189", "dst_port": 443, "proto": "tcp"}
{"ts": "2026-09-14T08:47:29Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T08:47:32Z", "host": "EWS-07", "event": "file_write", "pid": 2276, "image": "C:\\Program Files\\AquaWorks\\Common\\aqualog.exe", "path": "C:\\ProgramData\\AquaWorks\\Logs\\aqualog-20260914.log"}
{"ts": "2026-09-14T08:51:30Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T08:52:00Z", "host": "EWS-07", "event": "process_exit", "pid": 7216, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"}
{"ts": "2026-09-14T08:56:32Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T08:59:29Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T09:00:05Z", "host": "EWS-07", "event": "process_start", "pid": 7540, "ppid": 828, "image": "C:\\Windows\\System32\\cmd.exe", "cmdline": "C:\\Windows\\system32\\cmd.exe /c \"C:\\Scripts\\disk-report.cmd\"", "user": "NT AUTHORITY\\SYSTEM", "sha256": "43e2535b3fdbe4070d2c84f04407348c79dc6ca6f8b8e32b33db9477409780e0"}
{"ts": "2026-09-14T09:00:09Z", "host": "EWS-07", "event": "file_write", "pid": 7540, "image": "C:\\Windows\\System32\\cmd.exe", "path": "C:\\Scripts\\out\\disk-09.txt"}
{"ts": "2026-09-14T09:00:11Z", "host": "EWS-07", "event": "process_exit", "pid": 7540, "image": "C:\\Windows\\System32\\cmd.exe"}
{"ts": "2026-09-14T09:01:00Z", "host": "EWS-07", "event": "process_start", "pid": 1604, "ppid": 1840, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "cmdline": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=renderer --lang=en-US", "user": "PLANT\\eng.rmoss", "sha256": "b325a6fabe9a6b3069324026e588e3b6d25a11fbea19d254ec2e322d9a16dacf"}
{"ts": "2026-09-14T09:01:02Z", "host": "EWS-07", "event": "net_connect", "pid": 1604, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "dst_ip": "198.51.100.85", "dst_port": 443, "proto": "tcp"}
{"ts": "2026-09-14T09:04:21Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T09:08:00Z", "host": "EWS-07", "event": "process_exit", "pid": 4924, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"}
{"ts": "2026-09-14T09:09:18Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T09:13:33Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T09:17:25Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T09:17:28Z", "host": "EWS-07", "event": "file_write", "pid": 2276, "image": "C:\\Program Files\\AquaWorks\\Common\\aqualog.exe", "path": "C:\\ProgramData\\AquaWorks\\Logs\\aqualog-20260914.log"}
{"ts": "2026-09-14T09:21:00Z", "host": "EWS-07", "event": "process_exit", "pid": 1604, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"}
{"ts": "2026-09-14T09:21:19Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T09:24:20Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T09:27:34Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T09:32:27Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T09:32:30Z", "host": "EWS-07", "event": "file_write", "pid": 2276, "image": "C:\\Program Files\\AquaWorks\\Common\\aqualog.exe", "path": "C:\\ProgramData\\AquaWorks\\Logs\\aqualog-20260914.log"}
{"ts": "2026-09-14T09:37:00Z", "host": "EWS-07", "event": "process_start", "pid": 9040, "ppid": 1840, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "cmdline": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=renderer --lang=en-US", "user": "PLANT\\eng.rmoss", "sha256": "b325a6fabe9a6b3069324026e588e3b6d25a11fbea19d254ec2e322d9a16dacf"}
{"ts": "2026-09-14T09:37:02Z", "host": "EWS-07", "event": "net_connect", "pid": 9040, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "dst_ip": "198.51.100.79", "dst_port": 443, "proto": "tcp"}
{"ts": "2026-09-14T09:37:43Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T09:42:48Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T09:45:02Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T09:50:18Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T09:55:14Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T09:58:45Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:02:00Z", "host": "EWS-07", "event": "process_exit", "pid": 9040, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"}
{"ts": "2026-09-14T10:02:38Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:02:41Z", "host": "EWS-07", "event": "file_write", "pid": 2276, "image": "C:\\Program Files\\AquaWorks\\Common\\aqualog.exe", "path": "C:\\ProgramData\\AquaWorks\\Logs\\aqualog-20260914.log"}
{"ts": "2026-09-14T10:02:41Z", "host": "EWS-07", "event": "process_start", "pid": 4412, "ppid": 1840, "image": "C:\\Program Files\\AquaWorks\\AquaStudio\\AquaStudio.exe", "cmdline": "\"C:\\Program Files\\AquaWorks\\AquaStudio\\AquaStudio.exe\"", "user": "PLANT\\eng.rmoss", "sha256": "a7dcdf309ca0061ee0c281f5bea37f321e57367d0604ea905da9905f7541b6a5"}
{"ts": "2026-09-14T10:03:02Z", "host": "EWS-07", "event": "file_open", "pid": 4412, "image": "C:\\Program Files\\AquaWorks\\AquaStudio\\AquaStudio.exe", "path": "C:\\Projects\\PlantA\\PlantA_Clarifier.apx"}
{"ts": "2026-09-14T10:06:20Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:09:23Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:14:22Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:18:38Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:20:09Z", "host": "EWS-07", "event": "process_start", "pid": 4980, "ppid": 4412, "image": "C:\\Windows\\System32\\cmd.exe", "cmdline": "cmd.exe /c \"C:\\Program Files\\AquaWorks\\AquaStudio\\bin\\compile.cmd\" PlantA_Clarifier.apx", "user": "PLANT\\eng.rmoss", "sha256": "43e2535b3fdbe4070d2c84f04407348c79dc6ca6f8b8e32b33db9477409780e0"}
{"ts": "2026-09-14T10:20:09Z", "host": "EWS-07", "event": "process_start", "pid": 8228, "ppid": 4980, "image": "C:\\Windows\\System32\\conhost.exe", "cmdline": "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1", "user": "PLANT\\eng.rmoss", "sha256": "6ddf5c6881182822bf8b632bbfd055891a32fc471e25be683600b756181302eb"}
{"ts": "2026-09-14T10:20:10Z", "host": "EWS-07", "event": "process_start", "pid": 4864, "ppid": 4980, "image": "C:\\Program Files\\AquaWorks\\AquaStudio\\bin\\apxc.exe", "cmdline": "\"C:\\Program Files\\AquaWorks\\AquaStudio\\bin\\apxc.exe\" PlantA_Clarifier.apx /out C:\\Projects\\PlantA\\build", "user": "PLANT\\eng.rmoss", "sha256": "5c8c1b41e9548695fc97b03d8da232292ac6ad7dad5b92875b099a215d313213"}
{"ts": "2026-09-14T10:20:31Z", "host": "EWS-07", "event": "file_write", "pid": 4864, "image": "C:\\Program Files\\AquaWorks\\AquaStudio\\bin\\apxc.exe", "path": "C:\\Projects\\PlantA\\build\\PlantA_Clarifier.bin"}
{"ts": "2026-09-14T10:20:32Z", "host": "EWS-07", "event": "process_exit", "pid": 4864, "image": "C:\\Program Files\\AquaWorks\\AquaStudio\\bin\\apxc.exe"}
{"ts": "2026-09-14T10:20:33Z", "host": "EWS-07", "event": "process_exit", "pid": 4980, "image": "C:\\Windows\\System32\\cmd.exe"}
{"ts": "2026-09-14T10:20:33Z", "host": "EWS-07", "event": "process_exit", "pid": 8228, "image": "C:\\Windows\\System32\\conhost.exe"}
{"ts": "2026-09-14T10:22:13Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:25:18Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:30:22Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:33:21Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:36:02Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:39:04Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:43:06Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:46:24Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:51:34Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:55:00Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T10:58:00Z", "host": "EWS-07", "event": "process_start", "pid": 7968, "ppid": 1840, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "cmdline": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=renderer --lang=en-US", "user": "PLANT\\eng.rmoss", "sha256": "b325a6fabe9a6b3069324026e588e3b6d25a11fbea19d254ec2e322d9a16dacf"}
{"ts": "2026-09-14T10:58:02Z", "host": "EWS-07", "event": "net_connect", "pid": 7968, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "dst_ip": "198.51.100.17", "dst_port": 443, "proto": "tcp"}
{"ts": "2026-09-14T10:59:05Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T11:00:05Z", "host": "EWS-07", "event": "process_start", "pid": 1872, "ppid": 828, "image": "C:\\Windows\\System32\\cmd.exe", "cmdline": "C:\\Windows\\system32\\cmd.exe /c \"C:\\Scripts\\disk-report.cmd\"", "user": "NT AUTHORITY\\SYSTEM", "sha256": "43e2535b3fdbe4070d2c84f04407348c79dc6ca6f8b8e32b33db9477409780e0"}
{"ts": "2026-09-14T11:00:09Z", "host": "EWS-07", "event": "file_write", "pid": 1872, "image": "C:\\Windows\\System32\\cmd.exe", "path": "C:\\Scripts\\out\\disk-11.txt"}
{"ts": "2026-09-14T11:00:11Z", "host": "EWS-07", "event": "process_exit", "pid": 1872, "image": "C:\\Windows\\System32\\cmd.exe"}
{"ts": "2026-09-14T11:04:50Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T11:09:18Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T11:12:42Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T11:16:27Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T11:18:00Z", "host": "EWS-07", "event": "process_exit", "pid": 7968, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"}
{"ts": "2026-09-14T11:20:43Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T11:24:18Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T11:25:00Z", "host": "EWS-07", "event": "process_start", "pid": 7020, "ppid": 1840, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "cmdline": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=renderer --lang=en-US", "user": "PLANT\\eng.rmoss", "sha256": "b325a6fabe9a6b3069324026e588e3b6d25a11fbea19d254ec2e322d9a16dacf"}
{"ts": "2026-09-14T11:25:02Z", "host": "EWS-07", "event": "net_connect", "pid": 7020, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "dst_ip": "198.51.100.162", "dst_port": 443, "proto": "tcp"}
{"ts": "2026-09-14T11:28:13Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T11:33:14Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T11:38:23Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T11:41:52Z", "host": "EWS-07", "event": "file_open", "pid": 4412, "image": "C:\\Program Files\\AquaWorks\\AquaStudio\\AquaStudio.exe", "path": "E:\\PlantB\\PlantB_Filtration.apx"}
{"ts": "2026-09-14T11:42:07Z", "host": "EWS-07", "event": "process_start", "pid": 5120, "ppid": 4412, "image": "C:\\Windows\\System32\\cmd.exe", "cmdline": "cmd.exe /c \"E:\\PlantB\\.build\\prebuild.cmd\"", "user": "PLANT\\eng.rmoss", "sha256": "43e2535b3fdbe4070d2c84f04407348c79dc6ca6f8b8e32b33db9477409780e0"}
{"ts": "2026-09-14T11:42:07Z", "host": "EWS-07", "event": "process_start", "pid": 5468, "ppid": 5120, "image": "C:\\Windows\\System32\\conhost.exe", "cmdline": "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1", "user": "PLANT\\eng.rmoss", "sha256": "6ddf5c6881182822bf8b632bbfd055891a32fc471e25be683600b756181302eb"}
{"ts": "2026-09-14T11:42:08Z", "host": "EWS-07", "event": "process_start", "pid": 5136, "ppid": 5120, "image": "C:\\Windows\\System32\\cmd.exe", "cmdline": "cmd.exe /c copy /y \"E:\\PlantB\\.build\\tools\\aqualog.exe\" \"C:\\Users\\Public\\Libraries\\aqualog.exe\"", "user": "PLANT\\eng.rmoss", "sha256": "43e2535b3fdbe4070d2c84f04407348c79dc6ca6f8b8e32b33db9477409780e0"}
{"ts": "2026-09-14T11:42:08Z", "host": "EWS-07", "event": "file_write", "pid": 5136, "image": "C:\\Windows\\System32\\cmd.exe", "path": "C:\\Users\\Public\\Libraries\\aqualog.exe"}
{"ts": "2026-09-14T11:42:09Z", "host": "EWS-07", "event": "process_exit", "pid": 5136, "image": "C:\\Windows\\System32\\cmd.exe"}
{"ts": "2026-09-14T11:42:10Z", "host": "EWS-07", "event": "process_start", "pid": 6028, "ppid": 5120, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "cmdline": "\"C:\\Users\\Public\\Libraries\\aqualog.exe\" --rotate daily --tag bGFudGVybg==", "user": "PLANT\\eng.rmoss", "sha256": "4dd2c9e670b62673315aaa5535fb371043cdd4ef7ba3d7e16a90d55e63a04944"}
{"ts": "2026-09-14T11:42:12Z", "host": "EWS-07", "event": "process_exit", "pid": 5120, "image": "C:\\Windows\\System32\\cmd.exe"}
{"ts": "2026-09-14T11:42:12Z", "host": "EWS-07", "event": "process_exit", "pid": 5468, "image": "C:\\Windows\\System32\\conhost.exe"}
{"ts": "2026-09-14T11:42:26Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T11:44:51Z", "host": "EWS-07", "event": "net_connect", "pid": 6028, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "dst_ip": "10.20.5.20", "dst_port": 4840, "proto": "tcp"}
{"ts": "2026-09-14T11:45:00Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T11:48:19Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T11:51:00Z", "host": "EWS-07", "event": "process_start", "pid": 2476, "ppid": 1840, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "cmdline": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=renderer --lang=en-US", "user": "PLANT\\eng.rmoss", "sha256": "b325a6fabe9a6b3069324026e588e3b6d25a11fbea19d254ec2e322d9a16dacf"}
{"ts": "2026-09-14T11:51:02Z", "host": "EWS-07", "event": "net_connect", "pid": 2476, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "dst_ip": "198.51.100.10", "dst_port": 443, "proto": "tcp"}
{"ts": "2026-09-14T11:51:12Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T11:52:00Z", "host": "EWS-07", "event": "process_exit", "pid": 7020, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"}
{"ts": "2026-09-14T11:53:42Z", "host": "EWS-07", "event": "net_connect", "pid": 6028, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "dst_ip": "10.20.5.20", "dst_port": 4840, "proto": "tcp"}
{"ts": "2026-09-14T11:56:01Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:01:44Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:02:21Z", "host": "EWS-07", "event": "net_connect", "pid": 6028, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "dst_ip": "10.20.5.20", "dst_port": 4840, "proto": "tcp"}
{"ts": "2026-09-14T12:06:01Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:10:48Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:11:22Z", "host": "EWS-07", "event": "net_connect", "pid": 6028, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "dst_ip": "10.20.5.20", "dst_port": 4840, "proto": "tcp"}
{"ts": "2026-09-14T12:13:29Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:16:00Z", "host": "EWS-07", "event": "process_start", "pid": 8848, "ppid": 1840, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "cmdline": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=renderer --lang=en-US", "user": "PLANT\\eng.rmoss", "sha256": "b325a6fabe9a6b3069324026e588e3b6d25a11fbea19d254ec2e322d9a16dacf"}
{"ts": "2026-09-14T12:16:02Z", "host": "EWS-07", "event": "net_connect", "pid": 8848, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "dst_ip": "198.51.100.116", "dst_port": 443, "proto": "tcp"}
{"ts": "2026-09-14T12:18:00Z", "host": "EWS-07", "event": "process_start", "pid": 9204, "ppid": 1840, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "cmdline": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=renderer --lang=en-US", "user": "PLANT\\eng.rmoss", "sha256": "b325a6fabe9a6b3069324026e588e3b6d25a11fbea19d254ec2e322d9a16dacf"}
{"ts": "2026-09-14T12:18:02Z", "host": "EWS-07", "event": "net_connect", "pid": 9204, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "dst_ip": "198.51.100.200", "dst_port": 443, "proto": "tcp"}
{"ts": "2026-09-14T12:18:42Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:20:00Z", "host": "EWS-07", "event": "process_exit", "pid": 2476, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"}
{"ts": "2026-09-14T12:23:38Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:26:04Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:31:00Z", "host": "EWS-07", "event": "process_start", "pid": 5492, "ppid": 1840, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "cmdline": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=renderer --lang=en-US", "user": "PLANT\\eng.rmoss", "sha256": "b325a6fabe9a6b3069324026e588e3b6d25a11fbea19d254ec2e322d9a16dacf"}
{"ts": "2026-09-14T12:31:02Z", "host": "EWS-07", "event": "net_connect", "pid": 5492, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "dst_ip": "198.51.100.51", "dst_port": 443, "proto": "tcp"}
{"ts": "2026-09-14T12:31:34Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:31:40Z", "host": "EWS-07", "event": "process_exit", "pid": 6028, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe"}
{"ts": "2026-09-14T12:33:00Z", "host": "EWS-07", "event": "process_exit", "pid": 8848, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"}
{"ts": "2026-09-14T12:34:00Z", "host": "EWS-07", "event": "process_exit", "pid": 9204, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"}
{"ts": "2026-09-14T12:35:00Z", "host": "EWS-07", "event": "process_start", "pid": 6332, "ppid": 1840, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "cmdline": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=renderer --lang=en-US", "user": "PLANT\\eng.rmoss", "sha256": "b325a6fabe9a6b3069324026e588e3b6d25a11fbea19d254ec2e322d9a16dacf"}
{"ts": "2026-09-14T12:35:02Z", "host": "EWS-07", "event": "net_connect", "pid": 6332, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "dst_ip": "198.51.100.112", "dst_port": 443, "proto": "tcp"}
{"ts": "2026-09-14T12:35:37Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:37:00Z", "host": "EWS-07", "event": "process_start", "pid": 3856, "ppid": 1840, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "cmdline": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=renderer --lang=en-US", "user": "PLANT\\eng.rmoss", "sha256": "b325a6fabe9a6b3069324026e588e3b6d25a11fbea19d254ec2e322d9a16dacf"}
{"ts": "2026-09-14T12:37:02Z", "host": "EWS-07", "event": "net_connect", "pid": 3856, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "dst_ip": "198.51.100.114", "dst_port": 443, "proto": "tcp"}
{"ts": "2026-09-14T12:40:45Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:41:00Z", "host": "EWS-07", "event": "process_exit", "pid": 6332, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"}
{"ts": "2026-09-14T12:43:23Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:45:00Z", "host": "EWS-07", "event": "process_start", "pid": 7316, "ppid": 828, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "cmdline": "\"C:\\Users\\Public\\Libraries\\aqualog.exe\" --rotate daily --tag bGFudGVybg==", "user": "NT AUTHORITY\\SYSTEM", "sha256": "4dd2c9e670b62673315aaa5535fb371043cdd4ef7ba3d7e16a90d55e63a04944"}
{"ts": "2026-09-14T12:46:49Z", "host": "EWS-07", "event": "net_connect", "pid": 7316, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "dst_ip": "10.20.5.20", "dst_port": 4840, "proto": "tcp"}
{"ts": "2026-09-14T12:48:21Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:51:00Z", "host": "EWS-07", "event": "process_start", "pid": 6916, "ppid": 1840, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "cmdline": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=renderer --lang=en-US", "user": "PLANT\\eng.rmoss", "sha256": "b325a6fabe9a6b3069324026e588e3b6d25a11fbea19d254ec2e322d9a16dacf"}
{"ts": "2026-09-14T12:51:02Z", "host": "EWS-07", "event": "net_connect", "pid": 6916, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "dst_ip": "198.51.100.135", "dst_port": 443, "proto": "tcp"}
{"ts": "2026-09-14T12:51:30Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:53:14Z", "host": "EWS-07", "event": "net_connect", "pid": 7316, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "dst_ip": "10.20.5.20", "dst_port": 4840, "proto": "tcp"}
{"ts": "2026-09-14T12:54:08Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T12:56:00Z", "host": "EWS-07", "event": "process_exit", "pid": 3856, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"}
{"ts": "2026-09-14T12:57:00Z", "host": "EWS-07", "event": "process_exit", "pid": 5492, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"}
{"ts": "2026-09-14T12:57:26Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T13:00:05Z", "host": "EWS-07", "event": "process_start", "pid": 1332, "ppid": 828, "image": "C:\\Windows\\System32\\cmd.exe", "cmdline": "C:\\Windows\\system32\\cmd.exe /c \"C:\\Scripts\\disk-report.cmd\"", "user": "NT AUTHORITY\\SYSTEM", "sha256": "43e2535b3fdbe4070d2c84f04407348c79dc6ca6f8b8e32b33db9477409780e0"}
{"ts": "2026-09-14T13:00:05Z", "host": "EWS-07", "event": "net_connect", "pid": 7316, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "dst_ip": "10.20.5.20", "dst_port": 4840, "proto": "tcp"}
{"ts": "2026-09-14T13:00:09Z", "host": "EWS-07", "event": "file_write", "pid": 1332, "image": "C:\\Windows\\System32\\cmd.exe", "path": "C:\\Scripts\\out\\disk-13.txt"}
{"ts": "2026-09-14T13:00:11Z", "host": "EWS-07", "event": "process_exit", "pid": 1332, "image": "C:\\Windows\\System32\\cmd.exe"}
{"ts": "2026-09-14T13:02:42Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T13:02:45Z", "host": "EWS-07", "event": "file_write", "pid": 2276, "image": "C:\\Program Files\\AquaWorks\\Common\\aqualog.exe", "path": "C:\\ProgramData\\AquaWorks\\Logs\\aqualog-20260914.log"}
{"ts": "2026-09-14T13:04:00Z", "host": "EWS-07", "event": "process_exit", "pid": 6916, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"}
{"ts": "2026-09-14T13:07:05Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T13:07:10Z", "host": "EWS-07", "event": "net_connect", "pid": 7316, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "dst_ip": "10.20.5.20", "dst_port": 4840, "proto": "tcp"}
{"ts": "2026-09-14T13:12:03Z", "host": "EWS-07", "event": "process_start", "pid": 1384, "ppid": 1840, "image": "C:\\Windows\\System32\\notepad.exe", "cmdline": "\"C:\\Windows\\system32\\notepad.exe\" C:\\ProgramData\\AquaWorks\\Logs\\aqualog-20260914.log", "user": "PLANT\\eng.rmoss", "sha256": "5c60018dad61eed6c11357c656cd0f42264f2c00a08b79a6c40d97dab0d06a4f"}
{"ts": "2026-09-14T13:12:45Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T13:14:22Z", "host": "EWS-07", "event": "net_connect", "pid": 7316, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "dst_ip": "10.20.5.20", "dst_port": 4840, "proto": "tcp"}
{"ts": "2026-09-14T13:15:40Z", "host": "EWS-07", "event": "process_exit", "pid": 1384, "image": "C:\\Windows\\System32\\notepad.exe"}
{"ts": "2026-09-14T13:16:13Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T13:20:28Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T13:21:06Z", "host": "EWS-07", "event": "net_connect", "pid": 7316, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "dst_ip": "10.20.5.20", "dst_port": 4840, "proto": "tcp"}
{"ts": "2026-09-14T13:25:01Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T13:28:12Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T13:28:43Z", "host": "EWS-07", "event": "net_connect", "pid": 7316, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "dst_ip": "10.20.5.20", "dst_port": 4840, "proto": "tcp"}
{"ts": "2026-09-14T13:31:43Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T13:35:41Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T13:35:48Z", "host": "EWS-07", "event": "net_connect", "pid": 7316, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "dst_ip": "10.20.5.20", "dst_port": 4840, "proto": "tcp"}
{"ts": "2026-09-14T13:40:33Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.12", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T13:42:17Z", "host": "EWS-07", "event": "net_connect", "pid": 7316, "image": "C:\\Users\\Public\\Libraries\\aqualog.exe", "dst_ip": "10.20.5.20", "dst_port": 4840, "proto": "tcp"}
{"ts": "2026-09-14T13:44:00Z", "host": "EWS-07", "event": "process_start", "pid": 3052, "ppid": 1840, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "cmdline": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=renderer --lang=en-US", "user": "PLANT\\eng.rmoss", "sha256": "b325a6fabe9a6b3069324026e588e3b6d25a11fbea19d254ec2e322d9a16dacf"}
{"ts": "2026-09-14T13:44:01Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T13:44:02Z", "host": "EWS-07", "event": "net_connect", "pid": 3052, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "dst_ip": "198.51.100.203", "dst_port": 443, "proto": "tcp"}
{"ts": "2026-09-14T13:48:00Z", "host": "EWS-07", "event": "process_exit", "pid": 3052, "image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"}
{"ts": "2026-09-14T13:48:29Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T13:53:24Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T13:56:29Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.11", "dst_port": 502, "proto": "tcp"}
{"ts": "2026-09-14T14:01:45Z", "host": "EWS-07", "event": "net_connect", "pid": 2104, "image": "C:\\Program Files\\AquaWorks\\AquaView HMI\\aquaview.exe", "dst_ip": "10.20.5.13", "dst_port": 502, "proto": "tcp"}