Could this identification be through some alternate Windows service like Windows Update, Windows Time ntp server or Windows Defender?