_raw:
10/17/2025 09:09:35.468 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=238
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xAA7ADEE4
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x3D37C978


_raw:
10/17/2025 09:09:35.058 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=237
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw:
10/17/2025 09:09:35.057 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=236
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:09:17.203 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=238
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.218.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\182eebadb4845711485ec3c7036f9feddd770e07
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/17/2025 1:09:17 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/17/2025 09:09:15.911 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\78 = 0x2


_raw:
10/17/2025 09:09:15.911 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=241
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\83 = 0x1


_raw:
10/17/2025 09:09:15.870 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=237
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=240
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "g8PyOLsBDr0j+ODt7Cd6WWxRs4qhVZOoRvOieSpDrAo="
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "r2baIf/LDf0DOEMcgCUx4SlUp5LPDOls5rzYNQJwSNA="


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=239
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnablePersistedScanV2 = 0x1


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=238
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_CoreSvc_ResMon_MemLimit = 0x191


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=237
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpEnableNoMetaStoreProcessInfoContainer = 0x1


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=236
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerMonitorInterval = 0x493E0


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=235
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerInitalDelay = 0x493E2


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=234
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enforcement = 0x1


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=233
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdDisable1ds = 0x0


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=232
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableUpdateTriggerForSharedSigUpdates = 0x1


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=231
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableServiceRestartForSharedSigUpdates = 0x1


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=230
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdEnableCoreSvcRemediation = 0x1


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=229
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EcsConfigDownloadInterval = 0x3E


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=228
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdDisableResController = 0x0


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=227
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Md1dsMaxMemorySize = 0x8


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=226
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_RtpEnableDefenderConfigMonitoring = 0x1


_raw:
10/17/2025 09:09:15.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=225
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enable = 0x2


_raw:
10/17/2025 09:08:57.897 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=238
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.218.0
 	Antispyware security intelligence version: 1.439.218.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T07:07:36Z
 	Antispyware security intelligence creation time: 2025-10-16T07:07:35Z
 	Last quick scan start time: 2025-10-17T08:11:54Z
 	Last quick scan end time: 2025-10-17T08:13:58Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:08:39.700 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=258
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xAA7ADEE4
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x3D37C978


_raw:
10/17/2025 09:08:39.327 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=257
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:08:39.326 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=256
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:08:34.971 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=CPTC11-regionals-central-t9-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=250
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.244.0
 	Antispyware security intelligence version: 1.439.244.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-17T06:44:51Z
 	Antispyware security intelligence creation time: 2025-10-17T06:44:50Z
 	Last quick scan start time: 2025-10-17T07:51:30Z
 	Last quick scan end time: 2025-10-17T07:53:22Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:08:33.049 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=244
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "kvtegMip1fPqVr3s2FyBqJrWphtD5o5jr0NpA7QjGj0="
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "fiu+J3nW1dyMsihCZ7YGpwcZLXGLrnP+4K6ITsJCzDs="


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=243
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnablePersistedScanV2 = 0x1


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_CoreSvc_ResMon_MemLimit = 0x191


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=241
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpEnableNoMetaStoreProcessInfoContainer = 0x1


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=240
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerMonitorInterval = 0x493E0


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=239
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerInitalDelay = 0x493E2


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=238
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enforcement = 0x1


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=237
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdDisable1ds = 0x0


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=236
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableUpdateTriggerForSharedSigUpdates = 0x1


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=235
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableServiceRestartForSharedSigUpdates = 0x1


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=234
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdEnableCoreSvcRemediation = 0x1


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=233
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EcsConfigDownloadInterval = 0x3E


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=232
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdDisableResController = 0x0


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=231
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Md1dsMaxMemorySize = 0x8


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=230
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_RtpEnableDefenderConfigMonitoring = 0x1


_raw:
10/17/2025 09:08:33.048 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=229
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enable = 0x2


_raw:
10/17/2025 09:08:22.810 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=226
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.244.0
 	Antispyware security intelligence version: 1.439.244.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-17T06:44:51Z
 	Antispyware security intelligence creation time: 2025-10-17T06:44:50Z
 	Last quick scan start time: 2025-10-17T06:20:34Z
 	Last quick scan end time: 2025-10-17T06:22:58Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:08:16.980 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=236
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.220.0
 	Antispyware security intelligence version: 1.439.220.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T09:13:55Z
 	Antispyware security intelligence creation time: 2025-10-16T09:13:55Z
 	Last quick scan start time: 2025-10-17T06:39:28Z
 	Last quick scan end time: 2025-10-17T06:41:49Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:08:03.434 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=CPTC11-regionals-greatlakes-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=244
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.220.0
 	Antispyware security intelligence version: 1.439.220.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T09:13:55Z
 	Antispyware security intelligence creation time: 2025-10-16T09:13:55Z
 	Last quick scan start time: 2025-10-17T09:21:35Z
 	Last quick scan end time: 2025-10-17T09:23:16Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:07:39.962 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=221
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.218.0
 	Antispyware security intelligence version: 1.439.218.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T07:07:36Z
 	Antispyware security intelligence creation time: 2025-10-16T07:07:35Z
 	Last quick scan start time: 2025-10-17T08:04:34Z
 	Last quick scan end time: 2025-10-17T08:06:40Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:07:34.709 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/17/2025 09:07:34.708 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=241
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xAA7ADEE4
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x3D37C978


_raw:
10/17/2025 09:07:34.322 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=235
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.218.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\a6d1409fe828a8d9960284b510887676c740ab4e
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/17/2025 1:07:34 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/17/2025 09:07:34.304 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=240
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:07:34.304 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=239
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:07:33.436 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=234
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/17/2025 09:07:28.395 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=269
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xB67D892B
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x733E556D


_raw:
10/17/2025 09:07:28.053 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=268
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:07:28.051 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=267
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:07:12.214 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=238
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.218.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\e9932669f0a88ac735ee5f4f0ba41b25df08d974
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/17/2025 1:07:12 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/17/2025 09:07:10.686 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=237
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=257
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "nGYbYbObLPKEQr3MlznK1yZEEd77SbMra7/pwHnmwMc="
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "FbepaubUU+glKxWHozmvYbrXbeOqCRgc9LxV4cTY2Z8="


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=256
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_SCC_VerifyPayloadSignature = 0xFFFFFFEF


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=255
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_SCC_AcceptedSources = 0x1


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=254
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnablePersistedScanV2 = 0x1


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=253
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_CoreSvc_ResMon_MemLimit = 0x191


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=252
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpEnableNoMetaStoreProcessInfoContainer = 0x1


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=251
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerMonitorInterval = 0x493E0


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=250
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerInitalDelay = 0x493E2


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=249
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_SCC_FeatureAvailable = 0x1


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=248
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdDisable1ds = 0x0


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=247
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableUpdateTriggerForSharedSigUpdates = 0x1


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=246
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableServiceRestartForSharedSigUpdates = 0x1


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=245
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdEnableCoreSvcRemediation = 0x1


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=244
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EcsConfigDownloadInterval = 0x3E


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=243
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdDisableResController = 0x0


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Md1dsMaxMemorySize = 0x8


_raw:
10/17/2025 09:06:58.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=241
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_RtpEnableDefenderConfigMonitoring = 0x1


_raw:
10/17/2025 09:06:17.083 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=CPTC11-regionals-greatlakes-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=249
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.220.0
 	Antispyware security intelligence version: 1.439.220.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T09:13:55Z
 	Antispyware security intelligence creation time: 2025-10-16T09:13:55Z
 	Last quick scan start time: 2025-10-17T07:40:52Z
 	Last quick scan end time: 2025-10-17T07:42:37Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:05:55.952 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=251
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.244.0
 	Antispyware security intelligence version: 1.439.244.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-17T06:44:51Z
 	Antispyware security intelligence creation time: 2025-10-17T06:44:50Z
 	Last quick scan start time: 2025-10-17T08:08:26Z
 	Last quick scan end time: 2025-10-17T08:10:24Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:05:43.904 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=244
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.244.0
 	Antispyware security intelligence version: 1.439.244.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-17T06:44:51Z
 	Antispyware security intelligence creation time: 2025-10-17T06:44:50Z
 	Last quick scan start time: 2025-10-17T06:20:22Z
 	Last quick scan end time: 2025-10-17T06:22:52Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:05:42.889 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=CPTC11-regionals-greatlakes-t3-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=244
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.220.0
 	Antispyware security intelligence version: 1.439.220.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T09:13:55Z
 	Antispyware security intelligence creation time: 2025-10-16T09:13:55Z
 	Last quick scan start time: 2025-10-17T06:58:04Z
 	Last quick scan end time: 2025-10-17T06:59:53Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:05:20.880 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=251
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.244.0
 	Antispyware security intelligence version: 1.439.244.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-17T06:44:51Z
 	Antispyware security intelligence creation time: 2025-10-17T06:44:50Z
 	Last quick scan start time: 2025-10-17T07:21:56Z
 	Last quick scan end time: 2025-10-17T07:24:03Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:05:13.761 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=221
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.220.0
 	Antispyware security intelligence version: 1.439.220.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T09:13:55Z
 	Antispyware security intelligence creation time: 2025-10-16T09:13:55Z
 	Last quick scan start time: 2025-10-17T09:06:12Z
 	Last quick scan end time: 2025-10-17T09:08:13Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:04:39.683 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=246
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.220.0
 	Antispyware security intelligence version: 1.439.220.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T09:13:55Z
 	Antispyware security intelligence creation time: 2025-10-16T09:13:55Z
 	Last quick scan start time: 2025-10-17T07:07:57Z
 	Last quick scan end time: 2025-10-17T07:10:22Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:04:16.660 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=CPTC11-regionals-greatlakes-t3-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=260
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.220.0
 	Antispyware security intelligence version: 1.439.220.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T09:13:55Z
 	Antispyware security intelligence creation time: 2025-10-16T09:13:55Z
 	Last quick scan start time: 2025-10-17T07:01:26Z
 	Last quick scan end time: 2025-10-17T07:03:01Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:03:49.492 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=249
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.244.0
 	Antispyware security intelligence version: 1.439.244.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-17T06:44:51Z
 	Antispyware security intelligence creation time: 2025-10-17T06:44:50Z
 	Last quick scan start time: 2025-10-17T06:21:01Z
 	Last quick scan end time: 2025-10-17T06:23:00Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:02:50.371 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=234
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.218.0
 	Antispyware security intelligence version: 1.439.218.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 1
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T07:07:36Z
 	Antispyware security intelligence creation time: 2025-10-16T07:07:35Z
 	Last quick scan start time: 2025-10-16T06:00:16Z
 	Last quick scan end time: 2025-10-16T06:00:28Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:02:45.477 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=234
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.218.0
 	Antispyware security intelligence version: 1.439.218.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T07:07:36Z
 	Antispyware security intelligence creation time: 2025-10-16T07:07:35Z
 	Last quick scan start time: 2025-10-17T09:09:36Z
 	Last quick scan end time: 2025-10-17T09:11:48Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:02:42.427 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=235
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.244.0
 	Antispyware security intelligence version: 1.439.244.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-17T06:44:51Z
 	Antispyware security intelligence creation time: 2025-10-17T06:44:50Z
 	Last quick scan start time: 2025-10-17T06:23:38Z
 	Last quick scan end time: 2025-10-17T06:25:52Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:02:40.217 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=234
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.218.0
 	Antispyware security intelligence version: 1.439.218.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 1
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T07:07:36Z
 	Antispyware security intelligence creation time: 2025-10-16T07:07:35Z
 	Last quick scan start time: 2025-10-16T06:00:01Z
 	Last quick scan end time: 2025-10-16T06:00:14Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:02:15.990 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/17/2025 09:02:15.989 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=241
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xAA7ADEE4
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x3D37C978


_raw:
10/17/2025 09:02:15.527 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=240
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:02:15.526 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=239
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:01:57.983 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=CPTC11-regionals-greatlakes-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=265
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.220.0
 	Antispyware security intelligence version: 1.439.220.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T09:13:55Z
 	Antispyware security intelligence creation time: 2025-10-16T09:13:55Z
 	Last quick scan start time: 2025-10-17T08:12:13Z
 	Last quick scan end time: 2025-10-17T08:13:50Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:01:55.496 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=233
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.218.0
 	Antispyware security intelligence version: 1.439.218.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 1
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T07:07:36Z
 	Antispyware security intelligence creation time: 2025-10-16T07:07:35Z
 	Last quick scan start time: 2025-10-16T06:00:28Z
 	Last quick scan end time: 2025-10-16T06:00:41Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:01:51.340 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=244
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\104 = 0x1


_raw:
10/17/2025 09:01:51.332 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=243
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xAA7ADEE4
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x3D37C978


_raw:
10/17/2025 09:01:50.869 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:01:50.869 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=241
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:01:46.477 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=234
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.220.0
 	Antispyware security intelligence version: 1.439.220.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T09:13:55Z
 	Antispyware security intelligence creation time: 2025-10-16T09:13:55Z
 	Last quick scan start time: 2025-10-17T08:32:26Z
 	Last quick scan end time: 2025-10-17T08:34:50Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:01:39.938 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=CPTC11-regionals-greatlakes-t3-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=236
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.218.0
 	Antispyware security intelligence version: 1.439.218.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T07:07:36Z
 	Antispyware security intelligence creation time: 2025-10-16T07:07:35Z
 	Last quick scan start time: 2025-10-17T08:20:43Z
 	Last quick scan end time: 2025-10-17T08:22:36Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:01:02.633 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=CPTC11-regionals-central-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=224
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.244.0
 	Antispyware security intelligence version: 1.439.244.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-17T06:44:51Z
 	Antispyware security intelligence creation time: 2025-10-17T06:44:50Z
 	Last quick scan start time: 2025-10-17T06:44:54Z
 	Last quick scan end time: 2025-10-17T06:46:43Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:00:54.134 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=237
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.218.0
 	Antispyware security intelligence version: 1.439.218.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T07:07:36Z
 	Antispyware security intelligence creation time: 2025-10-16T07:07:35Z
 	Last quick scan start time: 2025-10-17T06:22:38Z
 	Last quick scan end time: 2025-10-17T06:24:44Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:00:49.236 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=245
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/17/2025 09:00:49.235 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=244
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xAA7ADEE4
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x3D37C978


_raw:
10/17/2025 09:00:48.772 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=243
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:00:48.772 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:00:17.675 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=265
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\104 = 0x1


_raw:
10/17/2025 09:00:17.674 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=264
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/17/2025 09:00:17.673 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=263
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xB67D892B
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x733E556D


_raw:
10/17/2025 09:00:17.193 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=262
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:00:17.192 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=261
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:00:13.968 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=248
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/17/2025 09:00:13.968 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=247
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xAA7ADEE4
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x3D37C978


_raw:
10/17/2025 09:00:13.488 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=246
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:00:13.488 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=CPTC11-regionals-central-t8-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=245
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.244.0
 	Previous security intelligence Version: 1.439.218.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/17/2025 09:00:12.752 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=228
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.244.0
 	Antispyware security intelligence version: 1.439.244.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-17T06:44:51Z
 	Antispyware security intelligence creation time: 2025-10-17T06:44:50Z
 	Last quick scan start time: 2025-10-17T07:17:43Z
 	Last quick scan end time: 2025-10-17T07:19:53Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:00:09.137 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=CPTC11-regionals-central-t10-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=250
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.244.0
 	Antispyware security intelligence version: 1.439.244.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-17T06:44:51Z
 	Antispyware security intelligence creation time: 2025-10-17T06:44:50Z
 	Last quick scan start time: 2025-10-17T09:36:17Z
 	Last quick scan end time: 2025-10-17T09:38:25Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 09:00:08.336 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=CPTC11-regionals-greatlakes-t9-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=237
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.218.0
 	Antispyware security intelligence version: 1.439.218.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T07:07:36Z
 	Antispyware security intelligence creation time: 2025-10-16T07:07:35Z
 	Last quick scan start time: 2025-10-17T09:27:24Z
 	Last quick scan end time: 2025-10-17T09:29:18Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/17/2025 08:59:55.663 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=219
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25080.5
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.218.0
 	Antispyware security intelligence version: 1.439.218.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 1
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-16T07:07:36Z
 	Antispyware security intelligence creation time: 2025-10-16T07:07:35Z
 	Last quick scan start time: 2025-10-16T06:00:27Z
 	Last quick scan end time: 2025-10-16T06:00:40Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000