_raw:
10/20/2025 04:57:37.595 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1910
 	Antispyware security intelligence age: 1910
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/20/2025 04:57:27.245 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=35
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1910
 	Antispyware security intelligence age: 1910
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw:
10/20/2025 04:57:07.067 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=33
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1910
 	Antispyware security intelligence age: 1910
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/20/2025 04:56:53.089 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1910
 	Antispyware security intelligence age: 1910
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/20/2025 04:56:01.445 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1910
 	Antispyware security intelligence age: 1910
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/20/2025 04:55:09.626 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1910
 	Antispyware security intelligence age: 1910
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/20/2025 04:54:28.879 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=34
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1910
 	Antispyware security intelligence age: 1910
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/20/2025 04:53:53.455 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=34
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1910
 	Antispyware security intelligence age: 1910
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/20/2025 04:37:01.315 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-FHP1RAT1ACM
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 04:37:01.315 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-FHP1RAT1ACM
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 04:32:46.012 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1910
 	Antispyware security intelligence age: 1910
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/20/2025 04:11:34.442 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=33
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {C790DA8C-57CF-415A-9537-9DA5044B0F3F}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:11:33.911 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {C790DA8C-57CF-415A-9537-9DA5044B0F3F}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:07:37.686 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=cptc11-regional-raul-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {3C77CC73-A672-44D8-B65F-2841103F3358}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:07:36.782 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {3C77CC73-A672-44D8-B65F-2841103F3358}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:07:27.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=cptc11-regional-raul-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=34
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {68C56ACC-3D9D-4C33-B7FC-0BA53A12292F}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:07:26.908 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=33
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {68C56ACC-3D9D-4C33-B7FC-0BA53A12292F}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:07:19.493 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 04:07:18.805 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
10/20/2025 04:07:07.686 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-5NBTADD87S4
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2


_raw:
10/20/2025 04:07:07.686 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-5NBTADD87S4
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2


_raw:
10/20/2025 04:07:07.357 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {5D1C4039-BF1D-4930-8580-B0F0EAD6E61D}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:07:07.161 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {5D1C4039-BF1D-4930-8580-B0F0EAD6E61D}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:07:03.562 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-5NBTADD87S4
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 04:07:03.562 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-5NBTADD87S4
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 04:06:53.122 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=cptc11-regional-raul-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {49917FA7-B996-42E1-91D5-32EC0250C507}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:06:52.216 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {49917FA7-B996-42E1-91D5-32EC0250C507}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:06:01.488 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=cptc11-regional-raul-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {5186C1F9-C1D5-4B6B-9C02-2C5960ACA60B}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:06:00.824 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {5186C1F9-C1D5-4B6B-9C02-2C5960ACA60B}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:05:10.146 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=cptc11-regional-raul-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {B0453DE0-7F7E-4B1F-9632-F753D15FC111}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:05:09.409 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {B0453DE0-7F7E-4B1F-9632-F753D15FC111}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:04:29.002 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=cptc11-regional-raul-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=33
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {3CF15BE6-9A07-4A1B-9AE3-690D6F03F85B}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:04:28.893 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {3CF15BE6-9A07-4A1B-9AE3-690D6F03F85B}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:04:26.768 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 04:04:26.485 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 04:04:26.128 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
10/20/2025 04:04:25.828 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
10/20/2025 04:03:53.507 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=cptc11-regional-raul-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=33
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {1D020C03-414A-4708-AB3E-CFBDDB8CDC00}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:03:52.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {1D020C03-414A-4708-AB3E-CFBDDB8CDC00}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 04:03:52.007 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 04:03:51.335 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
10/20/2025 04:02:20.656 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 04:02:20.000 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
10/20/2025 04:02:11.868 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 04:02:11.180 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
10/20/2025 04:01:51.026 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 04:01:50.087 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
10/20/2025 04:01:33.026 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 04:01:18.521 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 04:01:17.568 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
10/20/2025 04:00:12.873 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 04:00:11.857 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
10/20/2025 03:59:45.386 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:59:45.386 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:57:32.798 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:57:32.798 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:57:23.274 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:57:23.274 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:57:04.990 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:56:49.150 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:56:49.150 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:55:57.886 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:55:57.886 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:55:17.113 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:55:17.113 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:55:04.347 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:55:04.347 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:54:25.079 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:54:25.079 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:54:06.705 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=Deckhand-02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
10/20/2025 03:53:49.966 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:53:49.966 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:52:46.943 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
10/20/2025 03:52:23.165 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
10/20/2025 03:51:47.694 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
10/20/2025 03:51:10.675 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
10/20/2025 03:51:03.740 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:50:33.640 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:50:33.640 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:50:14.319 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
10/20/2025 03:49:42.315 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=Deckhand-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
10/20/2025 03:49:31.589 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
10/20/2025 03:49:25.721 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:49:09.152 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:48:54.043 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:48:54.043 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:48:50.750 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
10/20/2025 03:48:40.434 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:48:40.434 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:48:24.219 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:48:03.647 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:47:59.113 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:47:55.292 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:47:55.292 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:47:40.016 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:47:07.625 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:47:07.625 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:46:47.652 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:46:41.795 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:46:37.841 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:46:21.535 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:46:18.702 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:46:13.924 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:46:13.844 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:46:13.844 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:45:50.230 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:45:50.230 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:45:46.499 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:45:45.328 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:45:38.203 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:45:18.919 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:45:18.454 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:45:18.454 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:44:54.786 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:44:50.675 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:44:47.073 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:44:47.073 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:44:02.644 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:43:53.442 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:43:33.143 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:43:28.987 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:43:13.676 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-ICEE4EGUM6R
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x3


_raw:
10/20/2025 03:43:13.676 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-ICEE4EGUM6R
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampGradualRelease = 0x1


_raw:
10/20/2025 03:43:13.676 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-ICEE4EGUM6R
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x3


_raw:
10/20/2025 03:43:09.880 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:43:09.822 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-ICEE4EGUM6R
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:43:09.822 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-ICEE4EGUM6R
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:43:06.723 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:42:32.551 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:42:28.222 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:40:49.014 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:40:48.343 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
10/20/2025 03:32:42.108 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:32:42.108 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:31:18.660 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {1A3AD6E1-B584-4FD2-81C4-76805B22934C}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 03:31:17.327 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {1A3AD6E1-B584-4FD2-81C4-76805B22934C}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 03:25:10.246 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
10/20/2025 03:21:45.490 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:21:16.736 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 03:21:16.736 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 03:18:51.491 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 03:18:45.494 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 02:58:22.553 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {BBA6A50E-D887-4628-BA49-D9A857FE3B59}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 02:58:22.436 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {BBA6A50E-D887-4628-BA49-D9A857FE3B59}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 02:56:34.805 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-7N2TI7ATLTF
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
10/20/2025 02:56:34.804 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-7N2TI7ATLTF
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
10/20/2025 02:55:33.628 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=cptc11-regional-raul-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=33
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {B1689F3F-F275-43E6-B185-D3BAE1965331}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 02:55:32.795 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {B1689F3F-F275-43E6-B185-D3BAE1965331}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 02:55:01.418 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=cptc11-regional-raul-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {1D8B8041-E53C-46B3-A903-E7CBEE746B56}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 02:55:00.816 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {1D8B8041-E53C-46B3-A903-E7CBEE746B56}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 02:54:55.981 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=cptc11-regional-raul-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=33
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {3BD89C3B-D0CA-438F-8CBE-4AE9855A8212}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 02:54:55.394 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {3BD89C3B-D0CA-438F-8CBE-4AE9855A8212}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 02:54:16.569 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=cptc11-regional-raul-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=34
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {59B614DE-0960-45B8-9B08-DBAD7BC937FA}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 02:54:16.329 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=33
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {59B614DE-0960-45B8-9B08-DBAD7BC937FA}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 02:53:02.130 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1002
EventType=3
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=34
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has been stopped before completion.
 	Scan ID: {30288CE1-2F9D-49B0-BD5B-82DB5D476085}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
  	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 02:53:01.113 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=33
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {30288CE1-2F9D-49B0-BD5B-82DB5D476085}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
 	User: NT AUTHORITY\SYSTEM


_raw:
10/20/2025 02:52:54.379 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/20/2025 02:52:53.411 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
10/20/2025 02:52:23.058 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-raul-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0