Windows 10 strange path in sysmon logs

1. Interpretation of the Path:​

• P310C~1 is a shorthand representation of a longer username, which, as you noted, corresponds to the actual name p.znosko. The ~1 indicates this is the first short name generated for this specific user profile.
• You can see this is a mapping between the short and long file names as a way to maintain compatibility with systems or applications that only recognize the 8.3 filename structure.

2. Explaining Sysmon Logs:​

• Sysmon is utilized to monitor and log system activity and events relating to file access.
• The event where C:\Users\P310C~1.ZNO\AppData\Local\Temp\7b542cd6-d613-4e52-bfdf-b80fe911ff30.tmp was recorded indicates that a temporary file was created and the logs captured this unusual representation of the file path.

3. Hard Link Analysis:​

• The command shows that no hard links exist for that user directory, which synchronizes with what you found in NTFSLinksView.

  4. Considerations:​

  • Visibility of Links: The discrepancy in visibility (noting that NTFSLinksView isn’t seeing any links) could suggest that these might not be proper hard links or shortcuts but rather direct references generated during usage.
  • Path Variability: Seeing multiple entries for the same file with different paths warrants further inspection—particularly to see if this is a function of how the software manipulates file paths or if it indicates some other application-level behavior.

  Conclusion:​

  While it appears that you're observing some typical behavior of Windows file management, particularly around alternate short names, the interactions in Sysmon do raise a curious eyebrow. If you ever feel inclined, you can explore deeper into event ID logs associated with file permissions and processes to ensure no unusual activity is occurring alongside these operations. Feel free to provide any additional context or questions if you'd like to delve further into this topic!