_raw:
10/25/2025 02:55:28.406 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=314
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:28:19Z
 	Last quick scan end time: 2025-10-25T06:29:46Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:55:19.874 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=315
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {AE7F8070-D8E4-491B-BD88-80EC5FE52BF2}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:59

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw:
10/25/2025 02:55:06.521 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t4-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=311
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {40ABE613-5DE7-4218-B298-681AC51B6643}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 02:54:58.909 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t6-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=306
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:32:36Z
 	Last quick scan end time: 2025-10-25T06:34:28Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:54:47.206 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=342
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ServiceStartedSuccessfully


_raw:
10/25/2025 02:54:47.206 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=341
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xC18FA698
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xCCA9CB3F


_raw:
10/25/2025 02:54:43.659 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=340
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitPluginModules
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine


_raw:
10/25/2025 02:54:43.033 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=339
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitPluginModules


_raw:
10/25/2025 02:54:38.009 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=338
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitializeMiscConfigLibrary
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate


_raw:
10/25/2025 02:54:38.008 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=337
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xCCA9CB3F
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xC18FA698


_raw:
10/25/2025 02:54:38.008 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=336
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/25/2025 02:54:37.714 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5017
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=335
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus service feature has encountered an error and failed.
 	Feature: MDE AV Configurations
  	Failure Reason: Group Policy hive was not ready when MDE AV service started and AV configurations might be not as expected.
 	Recommended Mitigation: Investigate recent changes in Group Policy server settings and reboot the device.
 	Error Code: 0x80070002
 	Error description: The system cannot find the file specified.


_raw:
10/25/2025 02:54:24.324 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=324
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {FFFA8F5A-8D76-4973-B383-9314ABEB7325}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:05:06


_raw:
10/25/2025 02:54:24.322 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1116
EventType=3
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=323
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
 For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:MSIL/SharpHound!rfn&threatid=2147782338&enterprise=0
 	Name: VirTool:MSIL/SharpHound!rfn
 	ID: 2147782338
 	Severity: Severe
 	Category: Tool
 	Path: containerfile:_C:\Users\Administrator\Desktop\BloodHound.zip; file:_C:\Users\Administrator\Desktop\BloodHound.zip->BloodHound-win32-x64/resources/app/Collectors/DebugBuilds/SharpHound.exe; file:_C:\Users\Administrator\Desktop\BloodHound.zip->BloodHound-win32-x64/resources/app/Collectors/SharpHound.exe
 	Detection Origin: Local machine
 	Detection Type: FastPath
 	Detection Source: System
 	User: NT AUTHORITY\SYSTEM
 	Process Name: Unknown
 	Security intelligence Version: AV: 1.439.432.0, AS: 1.439.432.0, NIS: 0.0.0.0
 	Engine Version: AM: 1.1.25090.3001, NIS: 0.0.0.0


_raw:
10/25/2025 02:54:24.320 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1116
EventType=3
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=322
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
 For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:MSIL/Purlion.B!MTB&threatid=2147838407&enterprise=0
 	Name: VirTool:MSIL/Purlion.B!MTB
 	ID: 2147838407
 	Severity: Severe
 	Category: Tool
 	Path: file:_C:\Users\Administrator\Desktop\Snaffler.exe
 	Detection Origin: Local machine
 	Detection Type: Concrete
 	Detection Source: System
 	User: NT AUTHORITY\SYSTEM
 	Process Name: Unknown
 	Security intelligence Version: AV: 1.439.432.0, AS: 1.439.432.0, NIS: 0.0.0.0
 	Engine Version: AM: 1.1.25090.3001, NIS: 0.0.0.0


_raw:
10/25/2025 02:54:24.318 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1116
EventType=3
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=321
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
 For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Leonem!rfn&threatid=2147827561&enterprise=0
 	Name: Trojan:Win32/Leonem!rfn
 	ID: 2147827561
 	Severity: Severe
 	Category: Trojan
 	Path: containerfile:_C:\Users\Administrator\Desktop\BloodHound.zip; file:_C:\Users\Administrator\Desktop\BloodHound.zip->BloodHound-win32-x64/resources/app/Collectors/DebugBuilds/SharpHound.ps1; file:_C:\Users\Administrator\Desktop\BloodHound.zip->BloodHound-win32-x64/resources/app/Collectors/SharpHound.ps1
 	Detection Origin: Local machine
 	Detection Type: FastPath
 	Detection Source: System
 	User: NT AUTHORITY\SYSTEM
 	Process Name: Unknown
 	Security intelligence Version: AV: 1.439.432.0, AS: 1.439.432.0, NIS: 0.0.0.0
 	Engine Version: AM: 1.1.25090.3001, NIS: 0.0.0.0


_raw:
10/25/2025 02:54:22.237 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {2A33C9F7-77A1-40E6-91EC-A97E0B5CD11C}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 02:54:16.921 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=320
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\8d189f4bc2808483e0835b20ba2a70021e1ac469
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 6:54:16 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 1728000000


_raw:
10/25/2025 02:54:15.720 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=319
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\f1d73d93a198b77a61810f957a3599ce51001e42
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 6:54:15 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 02:54:13.211 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=318
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\04054c0f48ecbc0334e4a200427518bea0b6ea79
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 6:54:13 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 02:54:12.860 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T09:34:45Z
 	Last quick scan end time: 2025-10-24T09:36:37Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:54:12.223 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=317
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\b2a60b064a1893c2e17929275d8915bf2f74805d
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 6:54:12 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 02:54:11.877 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=316
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\8aae622b37b429f3e5a5ce162cb7ebaf963dfa31
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 6:54:11 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 02:54:11.482 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=315
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\523a64cdb4a4d6344593b55d6d0e7edf9c3f6b77
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 6:54:11 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 02:54:10.989 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=314
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\97d8c4918497d6f8a14cb5eaf05fa584558fea43
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 6:54:10 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 1728000000


_raw:
10/25/2025 02:54:01.200 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t3-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=313
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T07:50:15Z
 	Last quick scan end time: 2025-10-24T07:51:46Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:53:39.014 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=311
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T07:50:02Z
 	Last quick scan end time: 2025-10-24T07:52:03Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:53:21.694 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t6-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=303
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T07:10:48Z
 	Last quick scan end time: 2025-10-24T07:12:24Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:53:20.594 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=314
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {AE7F8070-D8E4-491B-BD88-80EC5FE52BF2}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 02:53:20.394 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t3-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=313
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T08:36:33Z
 	Last quick scan end time: 2025-10-24T08:38:09Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:52:58.965 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t6-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=303
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T09:37:11Z
 	Last quick scan end time: 2025-10-24T09:38:51Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:52:50.364 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T09:10:17Z
 	Last quick scan end time: 2025-10-24T09:12:12Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:52:37.912 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t3-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T08:52:42Z
 	Last quick scan end time: 2025-10-24T08:54:16Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:52:35.296 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=305
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T08:18:51Z
 	Last quick scan end time: 2025-10-24T08:20:16Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:52:25.184 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {AB648A72-EA4E-445F-B9D7-3D1421C2E418}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:35


_raw:
10/25/2025 02:51:48.918 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t6-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=304
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T07:15:08Z
 	Last quick scan end time: 2025-10-24T07:16:35Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:51:14.477 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=313
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\3404442710ffd75d02672eff02d8a675bc893175
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 6:51:14 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 864000000


_raw:
10/25/2025 02:51:13.938 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=312
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\3a08ea42e630c996bc181e1c8c0c608f7cdc951c
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 6:51:13 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 864000000


_raw:
10/25/2025 02:51:12.966 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=311
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\1522b643af041e9e3a2ab41cd1e974a653be183b
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 6:51:12 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 864000000


_raw:
10/25/2025 02:51:12.077 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=310
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\6db9527d7b18f142929ccda0a8b6e35a3e4ece5b
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 6:51:12 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 864000000


_raw:
10/25/2025 02:50:56.172 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=327
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:32:57Z
 	Last quick scan end time: 2025-10-25T06:34:38Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:50:50.071 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=306
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {AB648A72-EA4E-445F-B9D7-3D1421C2E418}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 02:49:58.835 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=316
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:49:45.853 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=311
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T07:58:43Z
 	Last quick scan end time: 2025-10-24T08:00:11Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:49:36.085 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t5-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=319
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:49:31.594 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T09:22:44Z
 	Last quick scan end time: 2025-10-24T09:24:25Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:49:17.432 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {FFFA8F5A-8D76-4973-B383-9314ABEB7325}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 02:48:49.906 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=317
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.434.0
 	Antispyware security intelligence version: 1.439.434.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-25T01:36:02Z
 	Antispyware security intelligence creation time: 2025-10-25T01:36:01Z
 	Last quick scan start time: 2025-10-24T08:51:33Z
 	Last quick scan end time: 2025-10-24T08:53:36Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:48:46.698 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t5-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=304
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:48:08.477 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t5-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=304
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:47:54.497 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=304
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T09:39:03Z
 	Last quick scan end time: 2025-10-24T09:40:35Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:47:42.975 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t5-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=319
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:47:24.163 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=334
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\78 = 0x2
 	New value:


_raw:
10/25/2025 02:47:24.163 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=333
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\83 = 0x1
 	New value:


_raw:
10/25/2025 02:47:24.162 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=332
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ServiceStartedSuccessfully


_raw:
10/25/2025 02:47:24.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=331
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xC18FA698
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xCCA9CB3F


_raw:
10/25/2025 02:47:16.016 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=330
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine


_raw:
10/25/2025 02:47:16.016 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=329
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/25/2025 02:47:11.074 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=328
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitializeMiscConfigLibrary
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate


_raw:
10/25/2025 02:47:11.073 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=327
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xCCA9CB3F
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xC18FA698


_raw:
10/25/2025 02:47:11.073 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=326
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/25/2025 02:47:10.794 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5017
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=325
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus service feature has encountered an error and failed.
 	Feature: MDE AV Configurations
  	Failure Reason: Group Policy hive was not ready when MDE AV service started and AV configurations might be not as expected.
 	Recommended Mitigation: Investigate recent changes in Group Policy server settings and reboot the device.
 	Error Code: 0x80070002
 	Error description: The system cannot find the file specified.


_raw:
10/25/2025 02:46:56.436 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=324
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\CleanupComponentProgress = CleanupCompleted
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\CleanupComponentProgress = CleanupEngine


_raw:
10/25/2025 02:46:48.706 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t9-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=311
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {8E9869C2-D2A3-4B5B-8784-69F5EFC38907}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:33


_raw:
10/25/2025 02:46:32.234 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t5-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=302
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:46:23.621 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=304
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T09:23:10Z
 	Last quick scan end time: 2025-10-24T09:24:40Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:45:55.102 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=303
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.434.0
 	Antispyware security intelligence version: 1.439.434.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-25T01:36:02Z
 	Antispyware security intelligence creation time: 2025-10-25T01:36:01Z
 	Last quick scan start time: 2025-10-24T08:29:20Z
 	Last quick scan end time: 2025-10-24T08:31:05Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:45:51.206 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=305
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T06:50:50Z
 	Last quick scan end time: 2025-10-24T06:52:22Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:45:46.922 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:45:29.410 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=315
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T08:22:03Z
 	Last quick scan end time: 2025-10-24T08:23:37Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:45:25.622 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=306
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T08:16:44Z
 	Last quick scan end time: 2025-10-24T08:18:16Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:45:24.090 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:05:34Z
 	Last quick scan end time: 2025-10-25T06:07:25Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:45:15.580 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t9-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=310
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {8E9869C2-D2A3-4B5B-8784-69F5EFC38907}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 02:44:44.806 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {E2393F6B-DE79-413B-BADD-5484989B3BBB}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:44


_raw:
10/25/2025 02:43:53.813 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:43:51.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {9E90EED6-C01B-4DCA-AA30-DBF3E5317D06}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:40


_raw:
10/25/2025 02:43:43.279 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:43:34.907 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:43:21.262 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t4-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=310
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:43:20.728 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t8-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=305
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {725CFABB-B12D-4F38-A484-E9F4306F2A04}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:34


_raw:
10/25/2025 02:43:17.957 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=315
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:07:27Z
 	Last quick scan end time: 2025-10-25T06:09:00Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:42:59.851 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {E2393F6B-DE79-413B-BADD-5484989B3BBB}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 02:42:26.596 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=310
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:42:11.204 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t4-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=300
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:42:10.592 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=306
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {9E90EED6-C01B-4DCA-AA30-DBF3E5317D06}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 02:42:09.733 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t4-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=306
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:41:45.794 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t8-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=304
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {725CFABB-B12D-4F38-A484-E9F4306F2A04}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 02:41:32.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=306
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:31:15Z
 	Last quick scan end time: 2025-10-25T06:32:54Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:40:34.989 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t9-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:40:33.837 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=306
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T07:13:19Z
 	Last quick scan end time: 2025-10-24T07:15:07Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:40:24.545 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t9-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=312
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:40:06.626 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t9-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=311
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:40:03.752 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t9-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=305
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:39:56.885 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:39:49.202 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T09:26:57Z
 	Last quick scan end time: 2025-10-24T09:28:31Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:39:43.810 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T07:19:52Z
 	Last quick scan end time: 2025-10-24T07:21:26Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:39:43.426 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t4-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=305
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:39:24.686 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t9-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=316
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x0


_raw:
10/25/2025 02:39:16.270 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=311
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:39:06.246 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t9-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=317
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:38:43.260 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x0


_raw:
10/25/2025 02:38:39.484 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T09:50:43Z
 	Last quick scan end time: 2025-10-24T09:52:41Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:38:36.666 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=310
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T11:00:51Z
 	Last quick scan end time: 2025-10-24T11:02:30Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:38:18.667 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=317
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:38:00.967 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=306
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 2
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-22T13:14:03Z
 	Last quick scan end time: 2025-10-22T13:15:59Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:37:59.407 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:37:25.204 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T08:27:06Z
 	Last quick scan end time: 2025-10-24T08:28:47Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 02:36:59.374 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 02:36:51.104 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=313
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 2
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-22T13:59:44Z
 	Last quick scan end time: 2025-10-22T14:01:50Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000