_raw:
11/06/2025 11:54:38.517 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=62
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReportingLocation =
SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx
REST:https://wdcp.microsoft.com/wdcp.svc/submitReport
REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport
BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport
BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport

 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReportingLocation =
SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx
REST:https://wdcp.microsoft.com/wdcp.svc/submitReport
REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport
BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport
BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport
ENTRAHB:https://wdcp.microsoft.com/wdcp.svc/entraReport
ENTRAHB:https://wdcpalt.microsoft.com/wdcp.svc/entraReport


_raw:
11/06/2025 11:54:38.515 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=61
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\BddUpdateFailure = 0x0

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw:
11/06/2025 11:54:38.515 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=60
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\DeltaUpdateFailure = 0x0


_raw:
11/06/2025 11:54:38.515 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=59
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\9 = 0x1


_raw:
11/06/2025 11:54:38.515 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=58
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\7 = 0x1


_raw:
11/06/2025 11:54:38.395 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=57
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.16.0
 	Previous security intelligence Version: 1.321.69.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4


_raw:
11/06/2025 11:54:38.394 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=56
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.16.0
 	Previous security intelligence Version: 1.321.69.0
 	Security intelligence Type: AntiVirus
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4


_raw:
11/06/2025 11:54:38.394 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2002
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=55
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus engine version has been updated.
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4
 	User: NT AUTHORITY\SYSTEM


_raw:
11/06/2025 11:54:24.793 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=66
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReportingLocation =
SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx
REST:https://wdcp.microsoft.com/wdcp.svc/submitReport
REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport
BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport
BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport

 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReportingLocation =
SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx
REST:https://wdcp.microsoft.com/wdcp.svc/submitReport
REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport
BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport
BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport
ENTRAHB:https://wdcp.microsoft.com/wdcp.svc/entraReport
ENTRAHB:https://wdcpalt.microsoft.com/wdcp.svc/entraReport


_raw:
11/06/2025 11:54:24.788 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=65
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\BddUpdateFailure = 0x0


_raw:
11/06/2025 11:54:24.788 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=64
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\DeltaUpdateFailure = 0x0


_raw:
11/06/2025 11:54:24.788 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=63
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\9 = 0x1


_raw:
11/06/2025 11:54:24.788 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=62
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\7 = 0x1


_raw:
11/06/2025 11:54:24.764 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=61
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.16.0
 	Previous security intelligence Version: 1.321.69.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4


_raw:
11/06/2025 11:54:24.764 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=60
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.16.0
 	Previous security intelligence Version: 1.321.69.0
 	Security intelligence Type: AntiVirus
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4


_raw:
11/06/2025 11:54:24.764 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2002
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=59
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus engine version has been updated.
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4
 	User: NT AUTHORITY\SYSTEM


_raw:
11/06/2025 11:54:19.788 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=58
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2
 	New value:


_raw:
11/06/2025 11:54:19.788 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=57
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2
 	New value:


_raw:
11/06/2025 11:53:54.310 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-west-t2-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=54
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1926
 	Antispyware security intelligence age: 1926
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 11/6/2025 7:00:55 AM
 	Last quick scan end time: 11/6/2025 7:01:24 AM
 	Last quick scan source: 2
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:53:45.898 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=60
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReportingLocation =
SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx
REST:https://wdcp.microsoft.com/wdcp.svc/submitReport
REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport
BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport
BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport

 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReportingLocation =
SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx
REST:https://wdcp.microsoft.com/wdcp.svc/submitReport
REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport
BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport
BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport
ENTRAHB:https://wdcp.microsoft.com/wdcp.svc/entraReport
ENTRAHB:https://wdcpalt.microsoft.com/wdcp.svc/entraReport


_raw:
11/06/2025 11:53:45.894 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=59
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\BddUpdateFailure = 0x0


_raw:
11/06/2025 11:53:45.894 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=58
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\DeltaUpdateFailure = 0x0


_raw:
11/06/2025 11:53:45.894 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=57
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\9 = 0x1


_raw:
11/06/2025 11:53:45.894 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=56
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\7 = 0x1


_raw:
11/06/2025 11:53:45.740 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=55
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.16.0
 	Previous security intelligence Version: 1.321.69.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4


_raw:
11/06/2025 11:53:45.740 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=54
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.16.0
 	Previous security intelligence Version: 1.321.69.0
 	Security intelligence Type: AntiVirus
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4


_raw:
11/06/2025 11:53:45.739 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2002
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=53
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus engine version has been updated.
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4
 	User: NT AUTHORITY\SYSTEM


_raw:
11/06/2025 11:53:21.821 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-west-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=56
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1926
 	Antispyware security intelligence age: 1926
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 11/6/2025 7:00:22 AM
 	Last quick scan end time: 11/6/2025 7:00:51 AM
 	Last quick scan source: 2
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:53:17.851 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=205
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.14.0
 	Antispyware security intelligence version: 1.441.14.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-06T10:03:42Z
 	Antispyware security intelligence creation time: 2025-11-06T10:03:42Z
 	Last quick scan start time: 2025-11-06T07:02:06Z
 	Last quick scan end time: 2025-11-06T07:02:34Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=218
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "huGWBkltzQwfEgM07arUY7fIBRbRrIa1DvdybhnDWyg="
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "5VrvCimipx9IDXUmtIK0zb+c2DUFiGJIVtBzTwLwzC4="


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=217
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnablePersistedScanV2 = 0x1


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=216
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_CoreSvc_ResMon_MemLimit = 0x191


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=215
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpEnableNoMetaStoreProcessInfoContainer = 0x1


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=214
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerMonitorInterval = 0x493E0


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=213
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerInitalDelay = 0x493E2


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=212
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enforcement = 0x1


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=211
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdDisable1ds = 0x0


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=210
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableUpdateTriggerForSharedSigUpdates = 0x1


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=209
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableServiceRestartForSharedSigUpdates = 0x1


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=208
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdEnableCoreSvcRemediation = 0x1


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=207
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EcsConfigDownloadInterval = 0x3E


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=206
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdDisableResController = 0x0


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=205
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Md1dsMaxMemorySize = 0x8


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=204
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_RtpEnableDefenderConfigMonitoring = 0x1


_raw:
11/06/2025 11:53:12.861 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=203
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enable = 0x2


_raw:
11/06/2025 11:53:12.360 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=202
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.14.0
 	Antispyware security intelligence version: 1.441.14.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-06T10:03:42Z
 	Antispyware security intelligence creation time: 2025-11-06T10:03:42Z
 	Last quick scan start time: 2025-11-06T07:00:32Z
 	Last quick scan end time: 2025-11-06T07:01:00Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:53:05.176 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=221
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.14.0
 	Antispyware security intelligence version: 1.441.14.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-06T10:03:42Z
 	Antispyware security intelligence creation time: 2025-11-06T10:03:42Z
 	Last quick scan start time: 2025-11-06T07:00:38Z
 	Last quick scan end time: 2025-11-06T07:01:07Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:52:58.027 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=204
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.14.0
 	Antispyware security intelligence version: 1.441.14.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-06T10:03:42Z
 	Antispyware security intelligence creation time: 2025-11-06T10:03:42Z
 	Last quick scan start time: 2025-11-06T07:00:28Z
 	Last quick scan end time: 2025-11-06T07:00:59Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:52:55.053 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=60
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReportingLocation =
SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx
REST:https://wdcp.microsoft.com/wdcp.svc/submitReport
REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport
BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport
BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport

 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReportingLocation =
SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx
REST:https://wdcp.microsoft.com/wdcp.svc/submitReport
REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport
BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport
BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport
ENTRAHB:https://wdcp.microsoft.com/wdcp.svc/entraReport
ENTRAHB:https://wdcpalt.microsoft.com/wdcp.svc/entraReport


_raw:
11/06/2025 11:52:55.044 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=59
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\BddUpdateFailure = 0x0


_raw:
11/06/2025 11:52:55.044 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=58
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\DeltaUpdateFailure = 0x0


_raw:
11/06/2025 11:52:55.043 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=57
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\9 = 0x1


_raw:
11/06/2025 11:52:55.043 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=56
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\7 = 0x1


_raw:
11/06/2025 11:52:54.797 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=55
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.16.0
 	Previous security intelligence Version: 1.321.69.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4


_raw:
11/06/2025 11:52:54.797 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=54
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.16.0
 	Previous security intelligence Version: 1.321.69.0
 	Security intelligence Type: AntiVirus
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4


_raw:
11/06/2025 11:52:54.797 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2002
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=53
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus engine version has been updated.
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4
 	User: NT AUTHORITY\SYSTEM


_raw:
11/06/2025 11:52:50.907 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=59
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1926
 	Antispyware security intelligence age: 1926
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 11/6/2025 7:00:54 AM
 	Last quick scan end time: 11/6/2025 7:01:34 AM
 	Last quick scan source: 2
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:52:46.931 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=60
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReportingLocation =
SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx
REST:https://wdcp.microsoft.com/wdcp.svc/submitReport
REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport
BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport
BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport

 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReportingLocation =
SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx
REST:https://wdcp.microsoft.com/wdcp.svc/submitReport
REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport
BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport
BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport
ENTRAHB:https://wdcp.microsoft.com/wdcp.svc/entraReport
ENTRAHB:https://wdcpalt.microsoft.com/wdcp.svc/entraReport


_raw:
11/06/2025 11:52:46.923 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=59
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\BddUpdateFailure = 0x0


_raw:
11/06/2025 11:52:46.923 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=58
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\DeltaUpdateFailure = 0x0


_raw:
11/06/2025 11:52:46.923 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=57
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\9 = 0x1


_raw:
11/06/2025 11:52:46.923 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=56
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\7 = 0x1


_raw:
11/06/2025 11:52:46.810 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=55
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.16.0
 	Previous security intelligence Version: 1.321.69.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4


_raw:
11/06/2025 11:52:46.809 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=54
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.16.0
 	Previous security intelligence Version: 1.321.69.0
 	Security intelligence Type: AntiVirus
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4


_raw:
11/06/2025 11:52:46.800 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2002
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=53
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus engine version has been updated.
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.17300.4
 	User: NT AUTHORITY\SYSTEM


_raw:
11/06/2025 11:52:40.862 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=213
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.14.0
 	Antispyware security intelligence version: 1.441.14.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-06T10:03:42Z
 	Antispyware security intelligence creation time: 2025-11-06T10:03:42Z
 	Last quick scan start time: 2025-11-06T07:00:12Z
 	Last quick scan end time: 2025-11-06T07:00:42Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:52:38.089 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-west-t2-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=57
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1926
 	Antispyware security intelligence age: 1926
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 11/6/2025 7:00:39 AM
 	Last quick scan end time: 11/6/2025 7:01:09 AM
 	Last quick scan source: 2
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:52:00.349 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-west-t2-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=54
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1926
 	Antispyware security intelligence age: 1926
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 11/6/2025 7:01:00 AM
 	Last quick scan end time: 11/6/2025 7:01:31 AM
 	Last quick scan source: 2
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=217
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "huGWBkltzQwfEgM07arUY7fIBRbRrIa1DvdybhnDWyg="
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "5VrvCimipx9IDXUmtIK0zb+c2DUFiGJIVtBzTwLwzC4="


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=216
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnablePersistedScanV2 = 0x1


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=215
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_CoreSvc_ResMon_MemLimit = 0x191


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=214
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpEnableNoMetaStoreProcessInfoContainer = 0x1


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=213
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerMonitorInterval = 0x493E0


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=212
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerInitalDelay = 0x493E2


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=211
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enforcement = 0x1


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=210
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdDisable1ds = 0x0


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=209
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableUpdateTriggerForSharedSigUpdates = 0x1


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=208
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableServiceRestartForSharedSigUpdates = 0x1


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=207
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdEnableCoreSvcRemediation = 0x1


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=206
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EcsConfigDownloadInterval = 0x3E


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=205
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdDisableResController = 0x0


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=204
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Md1dsMaxMemorySize = 0x8


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=203
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_RtpEnableDefenderConfigMonitoring = 0x1


_raw:
11/06/2025 11:51:53.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=202
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enable = 0x2


_raw:
11/06/2025 11:51:51.902 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=201
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.14.0
 	Antispyware security intelligence version: 1.441.14.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-06T10:03:42Z
 	Antispyware security intelligence creation time: 2025-11-06T10:03:42Z
 	Last quick scan start time: 2025-11-06T07:00:28Z
 	Last quick scan end time: 2025-11-06T07:00:57Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:51:32.235 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-west-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=56
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1926
 	Antispyware security intelligence age: 1926
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 11/6/2025 7:00:33 AM
 	Last quick scan end time: 11/6/2025 7:01:03 AM
 	Last quick scan source: 2
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:50:46.486 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-west-t2-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=54
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1926
 	Antispyware security intelligence age: 1926
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 11/6/2025 7:00:47 AM
 	Last quick scan end time: 11/6/2025 7:01:17 AM
 	Last quick scan source: 2
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:50:06.475 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=202
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.14.0
 	Antispyware security intelligence version: 1.441.14.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-06T10:03:42Z
 	Antispyware security intelligence creation time: 2025-11-06T10:03:42Z
 	Last quick scan start time: 2025-11-06T07:00:28Z
 	Last quick scan end time: 2025-11-06T07:00:57Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:49:37.058 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=217
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.14.0
 	Antispyware security intelligence version: 1.441.14.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-06T10:03:42Z
 	Antispyware security intelligence creation time: 2025-11-06T10:03:42Z
 	Last quick scan start time: 2025-11-06T07:00:26Z
 	Last quick scan end time: 2025-11-06T07:01:13Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:49:17.400 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=228
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.14.0
 	Antispyware security intelligence version: 1.441.14.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-06T10:03:42Z
 	Antispyware security intelligence creation time: 2025-11-06T10:03:42Z
 	Last quick scan start time: 2025-11-06T07:00:49Z
 	Last quick scan end time: 2025-11-06T07:01:21Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:49:08.862 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=223
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.14.0
 	Antispyware security intelligence version: 1.441.14.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-06T10:03:42Z
 	Antispyware security intelligence creation time: 2025-11-06T10:03:42Z
 	Last quick scan start time: 2025-11-06T07:00:43Z
 	Last quick scan end time: 2025-11-06T07:01:13Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:48:41.511 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-west-t2-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=57
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1926
 	Antispyware security intelligence age: 1926
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 11/6/2025 7:00:42 AM
 	Last quick scan end time: 11/6/2025 7:01:21 AM
 	Last quick scan source: 2
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=219
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "Vu011GK6y5BU9YLcH7z7r1pOb8m9k6/3/c2hfaFr8uE="
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "86ajlK3ksKJY/X3rpSx/6NcEPV74BH7mY7hx+5IURa8="


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=218
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnablePersistedScanV2 = 0x1


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=217
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_CoreSvc_ResMon_MemLimit = 0x191


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=216
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpEnableNoMetaStoreProcessInfoContainer = 0x1


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=215
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerMonitorInterval = 0x493E0


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=214
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerInitalDelay = 0x493E2


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=213
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enforcement = 0x1


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=212
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdDisable1ds = 0x0


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=211
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableUpdateTriggerForSharedSigUpdates = 0x1


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=210
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableServiceRestartForSharedSigUpdates = 0x1


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=209
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdEnableCoreSvcRemediation = 0x1


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=208
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EcsConfigDownloadInterval = 0x3E


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=207
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdDisableResController = 0x0


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=206
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Md1dsMaxMemorySize = 0x8


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=205
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_RtpEnableDefenderConfigMonitoring = 0x1


_raw:
11/06/2025 11:48:35.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=204
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enable = 0x2


_raw:
11/06/2025 11:48:34.572 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=203
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.14.0
 	Antispyware security intelligence version: 1.441.14.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-06T10:03:42Z
 	Antispyware security intelligence creation time: 2025-11-06T10:03:42Z
 	Last quick scan start time: 2025-11-06T07:00:10Z
 	Last quick scan end time: 2025-11-06T07:00:41Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:48:33.832 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=201
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.14.0
 	Antispyware security intelligence version: 1.441.14.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-06T10:03:42Z
 	Antispyware security intelligence creation time: 2025-11-06T10:03:42Z
 	Last quick scan start time: 2025-11-06T07:00:22Z
 	Last quick scan end time: 2025-11-06T07:00:53Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:48:31.162 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=218
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "huGWBkltzQwfEgM07arUY7fIBRbRrIa1DvdybhnDWyg="
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "5VrvCimipx9IDXUmtIK0zb+c2DUFiGJIVtBzTwLwzC4="


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=217
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnablePersistedScanV2 = 0x1


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=216
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_CoreSvc_ResMon_MemLimit = 0x191


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=215
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpEnableNoMetaStoreProcessInfoContainer = 0x1


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=214
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerMonitorInterval = 0x493E0


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=213
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerInitalDelay = 0x493E2


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=212
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enforcement = 0x1


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=211
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdDisable1ds = 0x0


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=210
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableUpdateTriggerForSharedSigUpdates = 0x1


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=209
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableServiceRestartForSharedSigUpdates = 0x1


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=208
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdEnableCoreSvcRemediation = 0x1


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=207
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EcsConfigDownloadInterval = 0x3E


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=206
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdDisableResController = 0x0


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=205
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Md1dsMaxMemorySize = 0x8


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=204
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_RtpEnableDefenderConfigMonitoring = 0x1


_raw:
11/06/2025 11:48:31.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=203
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enable = 0x2


_raw:
11/06/2025 11:48:30.646 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-southeast-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=202
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.14.0
 	Antispyware security intelligence version: 1.441.14.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-06T10:03:42Z
 	Antispyware security intelligence creation time: 2025-11-06T10:03:42Z
 	Last quick scan start time: 2025-11-06T07:01:00Z
 	Last quick scan end time: 2025-11-06T07:01:37Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/06/2025 11:48:28.877 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=218
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "Vu011GK6y5BU9YLcH7z7r1pOb8m9k6/3/c2hfaFr8uE="
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "86ajlK3ksKJY/X3rpSx/6NcEPV74BH7mY7hx+5IURa8="


_raw:
11/06/2025 11:48:28.877 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t6-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=217
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnablePersistedScanV2 = 0x1