_raw:
10/25/2025 03:45:29.426 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=318
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T08:22:03Z
 	Last quick scan end time: 2025-10-24T08:23:37Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:45:25.634 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T08:16:44Z
 	Last quick scan end time: 2025-10-24T08:18:16Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw:
10/25/2025 03:45:24.075 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=310
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:05:34Z
 	Last quick scan end time: 2025-10-25T06:07:25Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:44:55.989 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=314
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {10CA4607-0BBC-4D65-90E1-FD627AB7535A}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:38


_raw:
10/25/2025 03:44:53.120 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t11-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {66D9E476-E5EB-4633-AE19-6568675A198A}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 03:44:41.207 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=310
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {08DF7AF8-DDD4-4DAC-B78D-6C1F3200FC37}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:49


_raw:
10/25/2025 03:44:39.936 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t8-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x0


_raw:
10/25/2025 03:43:17.945 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=317
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:07:27Z
 	Last quick scan end time: 2025-10-25T06:09:00Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:43:17.494 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=313
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {10CA4607-0BBC-4D65-90E1-FD627AB7535A}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 03:42:51.364 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {08DF7AF8-DDD4-4DAC-B78D-6C1F3200FC37}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 03:41:34.326 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {FC4836CE-348E-48E5-9AC6-8133D8D08120}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:41


_raw:
10/25/2025 03:41:32.875 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:31:15Z
 	Last quick scan end time: 2025-10-25T06:32:54Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:40:56.941 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1


_raw:
10/25/2025 03:40:33.748 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T07:11:55Z
 	Last quick scan end time: 2025-10-25T07:13:41Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:40:01.115 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t3-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=313
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {A01B4C0D-15F9-4BB3-B86A-9610E02571F6}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:31


_raw:
10/25/2025 03:39:52.716 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {FC4836CE-348E-48E5-9AC6-8133D8D08120}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 03:39:49.217 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=311
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T09:26:57Z
 	Last quick scan end time: 2025-10-24T09:28:31Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:39:43.817 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=312
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T07:19:52Z
 	Last quick scan end time: 2025-10-25T07:21:48Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:38:39.521 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T09:50:43Z
 	Last quick scan end time: 2025-10-24T09:52:41Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:38:36.503 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=311
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T11:00:51Z
 	Last quick scan end time: 2025-10-24T11:02:30Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:38:29.605 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t3-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=312
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {A01B4C0D-15F9-4BB3-B86A-9610E02571F6}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 03:38:00.976 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 2
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-22T13:14:03Z
 	Last quick scan end time: 2025-10-22T13:15:59Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:37:25.217 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=310
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T08:27:06Z
 	Last quick scan end time: 2025-10-24T08:28:47Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:36:51.118 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=314
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 2
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-22T13:59:44Z
 	Last quick scan end time: 2025-10-22T14:01:50Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:36:42.704 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T08:13:24Z
 	Last quick scan end time: 2025-10-24T08:14:53Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:36:28.110 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=306
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 2
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-22T14:10:45Z
 	Last quick scan end time: 2025-10-22T14:12:42Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:35:55.326 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=306
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 4
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-21T06:00:06Z
 	Last quick scan end time: 2025-10-21T06:00:54Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:35:45.423 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:54:22Z
 	Last quick scan end time: 2025-10-25T06:56:18Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:35:30.975 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:42:10Z
 	Last quick scan end time: 2025-10-25T06:43:51Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:34:13.154 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T09:29:40Z
 	Last quick scan end time: 2025-10-24T09:31:10Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:33:45.985 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=320
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T07:24:48Z
 	Last quick scan end time: 2025-10-25T07:26:35Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:33:45.277 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=321
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T15:18:53Z
 	Last quick scan end time: 2025-10-24T15:20:37Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:33:29.518 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=305
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 2
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-22T12:49:22Z
 	Last quick scan end time: 2025-10-22T12:51:13Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:33:25.332 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t4-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=313
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {75FD99BE-F25C-45F9-90D8-0E370DEC959C}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:40


_raw:
10/25/2025 03:32:56.870 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=315
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 4
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-21T06:00:48Z
 	Last quick scan end time: 2025-10-21T06:04:21Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:32:49.494 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=316
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T07:24:21Z
 	Last quick scan end time: 2025-10-25T07:26:11Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:32:45.746 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=311
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T07:12:55Z
 	Last quick scan end time: 2025-10-25T07:14:39Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:32:39.577 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=306
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 4
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-21T06:00:47Z
 	Last quick scan end time: 2025-10-21T06:01:51Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:32:12.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T08:06:24Z
 	Last quick scan end time: 2025-10-24T08:07:52Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:31:59.886 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=311
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T09:28:25Z
 	Last quick scan end time: 2025-10-24T09:30:04Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:31:48.155 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=302
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 4
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-21T06:00:12Z
 	Last quick scan end time: 2025-10-21T06:01:04Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:31:45.272 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t4-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=312
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {75FD99BE-F25C-45F9-90D8-0E370DEC959C}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 03:31:28.350 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=316
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:53:20Z
 	Last quick scan end time: 2025-10-25T06:55:19Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:31:10.746 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=318
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 2
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-23T01:56:42Z
 	Last quick scan end time: 2025-10-23T01:58:56Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:31:09.601 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=310
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:26:00Z
 	Last quick scan end time: 2025-10-25T06:27:30Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:30:38.351 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=318
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 4
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-21T06:00:44Z
 	Last quick scan end time: 2025-10-21T06:04:36Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:30:06.137 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=324
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {FB9AC4F4-D102-434A-858B-37D5A67F4E15}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:05:34


_raw:
10/25/2025 03:30:06.135 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1116
EventType=3
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=323
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
 For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:MSIL/SharpHound!rfn&threatid=2147782338&enterprise=0
 	Name: VirTool:MSIL/SharpHound!rfn
 	ID: 2147782338
 	Severity: Severe
 	Category: Tool
 	Path: containerfile:_C:\Users\Administrator\Desktop\BloodHound.zip; file:_C:\Users\Administrator\Desktop\BloodHound.zip->BloodHound-win32-x64/resources/app/Collectors/DebugBuilds/SharpHound.exe; file:_C:\Users\Administrator\Desktop\BloodHound.zip->BloodHound-win32-x64/resources/app/Collectors/SharpHound.exe
 	Detection Origin: Local machine
 	Detection Type: FastPath
 	Detection Source: System
 	User: NT AUTHORITY\SYSTEM
 	Process Name: Unknown
 	Security intelligence Version: AV: 1.439.432.0, AS: 1.439.432.0, NIS: 0.0.0.0
 	Engine Version: AM: 1.1.25090.3001, NIS: 0.0.0.0


_raw:
10/25/2025 03:30:06.134 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1116
EventType=3
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=322
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
 For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:MSIL/Purlion.B!MTB&threatid=2147838407&enterprise=0
 	Name: VirTool:MSIL/Purlion.B!MTB
 	ID: 2147838407
 	Severity: Severe
 	Category: Tool
 	Path: file:_C:\Users\Administrator\Desktop\Snaffler.exe
 	Detection Origin: Local machine
 	Detection Type: Concrete
 	Detection Source: System
 	User: NT AUTHORITY\SYSTEM
 	Process Name: Unknown
 	Security intelligence Version: AV: 1.439.432.0, AS: 1.439.432.0, NIS: 0.0.0.0
 	Engine Version: AM: 1.1.25090.3001, NIS: 0.0.0.0


_raw:
10/25/2025 03:30:06.132 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1116
EventType=3
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=321
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
 For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Leonem!rfn&threatid=2147827561&enterprise=0
 	Name: Trojan:Win32/Leonem!rfn
 	ID: 2147827561
 	Severity: Severe
 	Category: Trojan
 	Path: containerfile:_C:\Users\Administrator\Desktop\BloodHound.zip; file:_C:\Users\Administrator\Desktop\BloodHound.zip->BloodHound-win32-x64/resources/app/Collectors/DebugBuilds/SharpHound.ps1; file:_C:\Users\Administrator\Desktop\BloodHound.zip->BloodHound-win32-x64/resources/app/Collectors/SharpHound.ps1
 	Detection Origin: Local machine
 	Detection Type: FastPath
 	Detection Source: System
 	User: NT AUTHORITY\SYSTEM
 	Process Name: Unknown
 	Security intelligence Version: AV: 1.439.432.0, AS: 1.439.432.0, NIS: 0.0.0.0
 	Engine Version: AM: 1.1.25090.3001, NIS: 0.0.0.0


_raw:
10/25/2025 03:29:59.150 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=320
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\321afc4cbd866371396148c6cd879e892cf97ddf
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:29:59 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 1728000000


_raw:
10/25/2025 03:29:58.130 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=319
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\c3a6fe8e9e8b5efdfbda58c35b296a0db46e7dfa
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:29:58 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 03:29:54.402 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=318
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\92f98c2d0e5ae9f7ca33a4631f6915b4cb9fd115
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:29:54 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 03:29:53.863 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=317
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\af1ea6b530ca6b463a5dbb5cc4d7218fae16c23b
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:29:53 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 03:29:53.533 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=316
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\62ac46c353bff51d03c720008287731a3d285dac
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:29:53 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 03:29:53.123 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=315
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\9f1238f24db2f11644be9742a8545f6e13a91f1d
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:29:53 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 03:29:52.566 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=314
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\22158d441678eea5f2552f1362ffc608dcfcc9af
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:29:52 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 1728000000


_raw:
10/25/2025 03:29:24.659 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t8-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=305
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:17:52Z
 	Last quick scan end time: 2025-10-25T06:19:18Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:29:08.515 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T07:42:51Z
 	Last quick scan end time: 2025-10-24T07:44:25Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:28:51.851 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t4-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T07:09:35Z
 	Last quick scan end time: 2025-10-25T07:11:16Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:28:48.429 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=306
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T07:14:35Z
 	Last quick scan end time: 2025-10-25T07:16:25Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:28:45.633 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t8-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=306
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T08:06:32Z
 	Last quick scan end time: 2025-10-24T08:08:10Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:28:06.106 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t4-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {C120CAFC-93FC-4440-84D2-6E5AA50274B2}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:39


_raw:
10/25/2025 03:27:55.696 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=305
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {625B3C9C-9D2F-47DD-BB90-3B08DAFE5371}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:39


_raw:
10/25/2025 03:26:47.955 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t4-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=301
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T09:05:20Z
 	Last quick scan end time: 2025-10-24T09:06:53Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:26:35.826 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=319
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {1139576B-E658-47E8-BC57-F8F04C2B097D}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:47


_raw:
10/25/2025 03:26:31.434 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=313
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\60db59d0a100a14d04e7d4942ff4c018cd567fbe
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:26:31 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 864000000


_raw:
10/25/2025 03:26:30.961 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=312
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\8b9d45a3ecd8c3e12dc7a99e3d7be374395bb1ab
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:26:30 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 864000000


_raw:
10/25/2025 03:26:30.106 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=311
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\3e9a25eb6de213acbcd4322717c46315d3822e0d
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:26:30 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 864000000


_raw:
10/25/2025 03:26:29.493 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=310
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\0c47b64951e6fa38a7762369e6f73079e47df3a8
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:26:29 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 864000000


_raw:
10/25/2025 03:26:26.906 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t4-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {C120CAFC-93FC-4440-84D2-6E5AA50274B2}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 03:26:16.673 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=304
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {625B3C9C-9D2F-47DD-BB90-3B08DAFE5371}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 03:26:14.996 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t8-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=308
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-25T06:41:45Z
 	Last quick scan end time: 2025-10-25T06:43:20Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:26:11.643 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=315
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {28513B16-2855-41F9-949D-E874E15C250E}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:49


_raw:
10/25/2025 03:25:28.896 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x1
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger = 0x0


_raw:
10/25/2025 03:25:12.192 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T08:03:16Z
 	Last quick scan end time: 2025-10-24T08:05:20Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:24:48.436 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=318
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {1139576B-E658-47E8-BC57-F8F04C2B097D}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 03:24:39.948 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1116
EventType=3
ComputerName=cptc11-regional-emea-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=335
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
 For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:MSIL/SharpHound!rfn&threatid=2147782338&enterprise=0
 	Name: VirTool:MSIL/SharpHound!rfn
 	ID: 2147782338
 	Severity: Severe
 	Category: Tool
 	Path: containerfile:_C:\Users\Administrator\Desktop\BloodHound.zip; file:_C:\Users\Administrator\Desktop\BloodHound.zip->BloodHound-win32-x64/resources/app/Collectors/DebugBuilds/SharpHound.exe; file:_C:\Users\Administrator\Desktop\BloodHound.zip->BloodHound-win32-x64/resources/app/Collectors/SharpHound.exe
 	Detection Origin: Local machine
 	Detection Type: FastPath
 	Detection Source: System
 	User: NT AUTHORITY\SYSTEM
 	Process Name: Unknown
 	Security intelligence Version: AV: 1.439.432.0, AS: 1.439.432.0, NIS: 0.0.0.0
 	Engine Version: AM: 1.1.25090.3001, NIS: 0.0.0.0


_raw:
10/25/2025 03:24:33.416 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=334
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {16E98F5C-5FDF-4A81-B45E-0A2EAA3E6881}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:05:38


_raw:
10/25/2025 03:24:33.414 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1116
EventType=3
ComputerName=cptc11-regional-emea-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=333
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
 For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:MSIL/SharpHound!rfn&threatid=2147782338&enterprise=0
 	Name: VirTool:MSIL/SharpHound!rfn
 	ID: 2147782338
 	Severity: Severe
 	Category: Tool
 	Path: containerfile:_C:\Users\Administrator\Desktop\BloodHound.zip; file:_C:\Users\Administrator\Desktop\BloodHound.zip->BloodHound-win32-x64/resources/app/Collectors/DebugBuilds/SharpHound.exe
 	Detection Origin: Local machine
 	Detection Type: FastPath
 	Detection Source: System
 	User: NT AUTHORITY\SYSTEM
 	Process Name: Unknown
 	Security intelligence Version: AV: 1.439.432.0, AS: 1.439.432.0, NIS: 0.0.0.0
 	Engine Version: AM: 1.1.25090.3001, NIS: 0.0.0.0


_raw:
10/25/2025 03:24:33.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1116
EventType=3
ComputerName=cptc11-regional-emea-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=332
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
 For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:MSIL/Purlion.B!MTB&threatid=2147838407&enterprise=0
 	Name: VirTool:MSIL/Purlion.B!MTB
 	ID: 2147838407
 	Severity: Severe
 	Category: Tool
 	Path: file:_C:\Users\Administrator\Desktop\Snaffler.exe
 	Detection Origin: Local machine
 	Detection Type: Concrete
 	Detection Source: System
 	User: NT AUTHORITY\SYSTEM
 	Process Name: Unknown
 	Security intelligence Version: AV: 1.439.432.0, AS: 1.439.432.0, NIS: 0.0.0.0
 	Engine Version: AM: 1.1.25090.3001, NIS: 0.0.0.0


_raw:
10/25/2025 03:24:33.410 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1116
EventType=3
ComputerName=cptc11-regional-emea-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Warning
RecordNumber=331
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
 For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Leonem!rfn&threatid=2147827561&enterprise=0
 	Name: Trojan:Win32/Leonem!rfn
 	ID: 2147827561
 	Severity: Severe
 	Category: Trojan
 	Path: containerfile:_C:\Users\Administrator\Desktop\BloodHound.zip; file:_C:\Users\Administrator\Desktop\BloodHound.zip->BloodHound-win32-x64/resources/app/Collectors/DebugBuilds/SharpHound.ps1; file:_C:\Users\Administrator\Desktop\BloodHound.zip->BloodHound-win32-x64/resources/app/Collectors/SharpHound.ps1
 	Detection Origin: Local machine
 	Detection Type: FastPath
 	Detection Source: System
 	User: NT AUTHORITY\SYSTEM
 	Process Name: Unknown
 	Security intelligence Version: AV: 1.439.432.0, AS: 1.439.432.0, NIS: 0.0.0.0
 	Engine Version: AM: 1.1.25090.3001, NIS: 0.0.0.0


_raw:
10/25/2025 03:24:33.392 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=330
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\55acc124ef705f9f5013ab81194ba0e19384e681
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:24:33 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 864000000


_raw:
10/25/2025 03:24:32.042 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=309
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {FB9AC4F4-D102-434A-858B-37D5A67F4E15}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 03:24:25.853 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=329
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\afeae2b2414b225eaa9ec76347d25393e3153c30
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:24:25 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 1728000000


_raw:
10/25/2025 03:24:24.779 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=328
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\d8aa4b8cc031c363b8c9326d9b3e0c4aa7e0febb
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:24:24 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 03:24:21.880 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=327
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\39f5f6bfcccf8a19153f411f08656863be22c44b
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:24:21 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 03:24:21.847 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=314
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {28513B16-2855-41F9-949D-E874E15C250E}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 03:24:20.960 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=326
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\5141a4d27203681f94bef354e5314d6815f1b69c
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:24:20 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 03:24:20.596 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=325
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\fca0d1f730d24bd292735a306b8568c86f365b01
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:24:20 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 03:24:20.061 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=324
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\990714b20f8300ac809f5387290fff2d52ba768d
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:24:19 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 288000000


_raw:
10/25/2025 03:24:19.297 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-emea-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=323
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.432.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\ecf316e373d71d94053447d399660c517f79e603
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/25/2025 7:24:19 AM
 	Persistence Limit Type: Duration
 	Persistence Limit: 1728000000


_raw:
10/25/2025 03:24:05.454 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t5-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=307
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {43B7B187-7545-4F00-9DBA-077BFD150D66}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:53


_raw:
10/25/2025 03:23:24.704 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-emea-t8-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=317
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.432.0
 	Antispyware security intelligence version: 1.439.432.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-24T23:29:17Z
 	Antispyware security intelligence creation time: 2025-10-24T23:29:17Z
 	Last quick scan start time: 2025-10-24T08:03:53Z
 	Last quick scan end time: 2025-10-24T08:05:38Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/25/2025 03:22:11.676 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1000
EventType=4
ComputerName=cptc11-regional-emea-t5-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=306
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has started.
 	Scan ID: {43B7B187-7545-4F00-9DBA-077BFD150D66}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	Scan Resources:
  	User: NT AUTHORITY\SYSTEM
 	Scan Trigger: Scheduled maintenance
 	Scan Only If Idle: Enabled
 	Low CPU Priority for Scans: Disabled
 	Thread Priority: 7


_raw:
10/25/2025 03:21:48.708 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1001
EventType=4
ComputerName=cptc11-regional-emea-t10-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=311
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus scan has finished.
 	Scan ID: {A1E06FCC-97A0-488B-82ED-42039F628322}
 	Scan Type: Antimalware
 	Scan Parameters: Quick Scan
 	User: NT AUTHORITY\SYSTEM
 	Scan Time: 0:01:55