Account Unknown(S-1-15-3-65536-1888954469-739942743-1668119174-2468466756-4239452838-1296943325-355587736-700089176)

I've discovered the same account associated with "Special Permissions" on my OS Drive. Just removed it, but in the process made a connection back to a strange occurance around a month ago where the entire size of all of my harddrives were downloaded within two hours on the same day. Here are all of the logs from that day including a picture I took shortly after the discovery. Eventually "MSFT 5.0" masked itself with my Computer Name too.

It will not allow me to post the raw images on this thread so you can find all related logs in this google share drive.

Main folder with logs included from Norton Security/Windows/ASUS Router at time of occurance: https://drive.google.com/drive/folders/1DlowoBjYtDrfV7EydHf3lNqYUsj4Zk-5?usp=drive_link

SSID Before Spoof: https://drive.google.com/file/d/18EZ9NHzZpjISMOF1JHuJvvnOTta8wiPm/view?usp=drive_link

SSID After Spoof: https://drive.google.com/file/d/1r9JBJyKg67No-jEn61qXZJcAdn5KoU5O/view?usp=drive_link

You'll notice in the logs that Windows Update and General were the specified downloading applications, a little further digging and diahost.exe was responsible for the 1.3TB+ DL to who knows where.

Uff já mám něco podobného v pc taky , ale je tu ještě jedna věc do pc se mi dostal RDB WRAPPER a ja se ho nedokážu zbavit

It's actually WDAGUtilityAccount

Hi Imran,

I am Dave, I will help you with this.

Windows creates hidden security accounts in the background of the operating system, they all begin with S-1-15-XXXX, all Windows systems have those accounts, they are used for administrative tasks like Windows Security, installing updates, file management...etc. those accounts are normal and rest assured you have nothing to worry about, you should never try to remove those hidden accounts.

hello，I found an error while using git, related to this unknown account

hey imran i have same problem what can i do please tell me