Mail Spawn

Mercur Retail LLP is a retail chain. Process-start logs are collected from the workstations. A few hundred records accumulated over the day — a normal volume for an office.

Searching by process name is useless here: the name is chosen by whoever launches it, and they choose something that looks like a system process. You have to work with the pair — which process spawned which. That pair is determined by how the program got in, and is far harder to fake.

Fields: process.name for what started, process.parent.name for what started it, process.hash.sha256 for the hash. Timestamps are UTC.