_raw:
10/31/2025 03:21:35.082 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-newengland-t7-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=230
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.573.0
 	Antispyware security intelligence version: 1.439.573.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T13:36:40Z
 	Antispyware security intelligence creation time: 2025-10-30T13:36:39Z
 	Last quick scan start time: 2025-10-31T07:52:31Z
 	Last quick scan end time: 2025-10-31T07:54:40Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:19:54.593 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=246
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw:
10/31/2025 03:19:54.592 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=245
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xDB5DB5FB
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xF1C13334


_raw:
10/31/2025 03:19:54.139 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=244
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:19:54.139 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=243
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:19:50.306 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t9-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=269
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.575.0
 	Antispyware security intelligence version: 1.439.575.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T15:36:06Z
 	Antispyware security intelligence creation time: 2025-10-30T15:36:06Z
 	Last quick scan start time: 2025-10-31T08:15:53Z
 	Last quick scan end time: 2025-10-31T08:17:27Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:19:31.982 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.573.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\1444599406f95198c823e452114d648fce4d0916
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/31/2025 7:19:31 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/31/2025 03:19:31.176 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=241
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/31/2025 03:18:31.873 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=261
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\BddUpdateFailure = 0x0


_raw:
10/31/2025 03:18:31.873 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=260
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\DeltaUpdateFailure = 0x0


_raw:
10/31/2025 03:18:31.869 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=259
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/31/2025 03:18:31.868 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=258
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xDB5DB5FB
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xF1C13334


_raw:
10/31/2025 03:18:31.481 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=257
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:18:31.481 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=256
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:18:29.948 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-newengland-t3-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=241
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.573.0
 	Antispyware security intelligence version: 1.439.573.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T13:36:40Z
 	Antispyware security intelligence creation time: 2025-10-30T13:36:39Z
 	Last quick scan start time: 2025-10-31T08:41:27Z
 	Last quick scan end time: 2025-10-31T08:43:32Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:18:05.298 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=272
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.575.0
 	Antispyware security intelligence version: 1.439.575.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T15:36:06Z
 	Antispyware security intelligence creation time: 2025-10-30T15:36:06Z
 	Last quick scan start time: 2025-10-31T07:32:21Z
 	Last quick scan end time: 2025-10-31T07:34:39Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:17:56.153 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t9-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=270
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.575.0
 	Antispyware security intelligence version: 1.439.575.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T15:36:06Z
 	Antispyware security intelligence creation time: 2025-10-30T15:36:06Z
 	Last quick scan start time: 2025-10-31T06:05:07Z
 	Last quick scan end time: 2025-10-31T06:06:37Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:17:45.959 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=245
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/31/2025 03:17:45.958 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=244
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xDB5DB5FB
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xF1C13334


_raw:
10/31/2025 03:17:45.487 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=243
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:17:45.487 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:17:35.499 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-newengland-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.573.0
 	Antispyware security intelligence version: 1.439.573.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T13:36:40Z
 	Antispyware security intelligence creation time: 2025-10-30T13:36:39Z
 	Last quick scan start time: 2025-10-31T06:04:43Z
 	Last quick scan end time: 2025-10-31T06:06:51Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:17:28.265 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-newengland-t3-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=226
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.573.0
 	Antispyware security intelligence version: 1.439.573.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T13:36:40Z
 	Antispyware security intelligence creation time: 2025-10-30T13:36:39Z
 	Last quick scan start time: 2025-10-31T08:28:44Z
 	Last quick scan end time: 2025-10-31T08:30:53Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:17:27.998 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-newengland-t3-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=245
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.573.0
 	Antispyware security intelligence version: 1.439.573.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T13:36:40Z
 	Antispyware security intelligence creation time: 2025-10-30T13:36:39Z
 	Last quick scan start time: 2025-10-31T08:42:31Z
 	Last quick scan end time: 2025-10-31T08:44:39Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:17:27.472 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t9-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=267
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.575.0
 	Antispyware security intelligence version: 1.439.575.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T15:36:06Z
 	Antispyware security intelligence creation time: 2025-10-30T15:36:06Z
 	Last quick scan start time: 2025-10-31T06:29:42Z
 	Last quick scan end time: 2025-10-31T06:31:33Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:17:26.821 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=241
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.573.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\09f945e4fcda7c0664943c06a5be29a725e6d3e6
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/31/2025 7:17:26 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/31/2025 03:17:26.462 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=240
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/31/2025 03:17:20.988 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t9-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=277
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.575.0
 	Antispyware security intelligence version: 1.439.575.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T15:36:06Z
 	Antispyware security intelligence creation time: 2025-10-30T15:36:06Z
 	Last quick scan start time: 2025-10-31T07:30:03Z
 	Last quick scan end time: 2025-10-31T07:31:38Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:17:04.748 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=233
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.595.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\443e2c5d4bbc77ace1128114d3c38165281f2437
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/31/2025 7:17:04 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/31/2025 03:17:04.230 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=232
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/31/2025 03:17:04.230 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=231
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xBAD69140
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xF1C13334


_raw:
10/31/2025 03:17:04.229 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=230
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/31/2025 03:17:03.746 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=229
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:17:03.745 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=228
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:16:58.012 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t9-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=283
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.575.0
 	Antispyware security intelligence version: 1.439.575.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T15:36:06Z
 	Antispyware security intelligence creation time: 2025-10-30T15:36:06Z
 	Last quick scan start time: 2025-10-31T09:16:56Z
 	Last quick scan end time: 2025-10-31T09:18:19Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:16:57.519 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-newengland-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.573.0
 	Antispyware security intelligence version: 1.439.573.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T13:36:40Z
 	Antispyware security intelligence creation time: 2025-10-30T13:36:39Z
 	Last quick scan start time: 2025-10-31T07:13:27Z
 	Last quick scan end time: 2025-10-31T07:15:30Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:16:23.742 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t9-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=270
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.575.0
 	Antispyware security intelligence version: 1.439.575.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T15:36:06Z
 	Antispyware security intelligence creation time: 2025-10-30T15:36:06Z
 	Last quick scan start time: 2025-10-31T08:41:55Z
 	Last quick scan end time: 2025-10-31T08:43:26Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:16:20.442 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t9-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=268
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.575.0
 	Antispyware security intelligence version: 1.439.575.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T15:36:06Z
 	Antispyware security intelligence creation time: 2025-10-30T15:36:06Z
 	Last quick scan start time: 2025-10-31T06:22:12Z
 	Last quick scan end time: 2025-10-31T06:23:50Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:15:49.849 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=252
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "kvtegMip1fPqVr3s2FyBqJrWphtD5o5jr0NpA7QjGj0="
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "huCKQVMi3XX3k5WU8eiDqldPVFklJikM87MuPStqPX4="


_raw:
10/31/2025 03:15:49.848 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=251
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnablePersistedScanV2 = 0x1


_raw:
10/31/2025 03:15:49.848 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=250
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_CoreSvc_ResMon_MemLimit = 0x191


_raw:
10/31/2025 03:15:49.848 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=249
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpEnableNoMetaStoreProcessInfoContainer = 0x1


_raw:
10/31/2025 03:15:49.848 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=248
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerMonitorInterval = 0x493E0


_raw:
10/31/2025 03:15:49.848 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=247
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerInitalDelay = 0x493E2


_raw:
10/31/2025 03:15:49.848 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=246
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enforcement = 0x1


_raw:
10/31/2025 03:15:49.848 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=245
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdDisable1ds = 0x0


_raw:
10/31/2025 03:15:49.848 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=244
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableUpdateTriggerForSharedSigUpdates = 0x1


_raw:
10/31/2025 03:15:49.848 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=243
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableServiceRestartForSharedSigUpdates = 0x1


_raw:
10/31/2025 03:15:49.848 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdEnableCoreSvcRemediation = 0x1


_raw:
10/31/2025 03:15:49.848 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=241
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EcsConfigDownloadInterval = 0x3E


_raw:
10/31/2025 03:15:49.848 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=240
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdDisableResController = 0x0


_raw:
10/31/2025 03:15:49.848 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=239
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Md1dsMaxMemorySize = 0x8


_raw:
10/31/2025 03:15:49.848 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=238
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_RtpEnableDefenderConfigMonitoring = 0x1


_raw:
10/31/2025 03:15:49.847 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=237
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enable = 0x2


_raw:
10/31/2025 03:15:37.592 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=268
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x33799C70
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x19E51ABF


_raw:
10/31/2025 03:15:37.133 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=267
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
10/31/2025 03:15:37.132 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=266
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
10/31/2025 03:15:36.852 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=247
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/31/2025 03:15:36.852 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=246
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xDB5DB5FB
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xF1C13334


_raw:
10/31/2025 03:15:36.395 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=245
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:15:36.394 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=244
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:15:21.415 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=252
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/31/2025 03:15:21.415 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=251
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xDB5DB5FB
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xF1C13334


_raw:
10/31/2025 03:15:20.938 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=250
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:15:20.938 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=249
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:15:16.325 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=243
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.573.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\1ad620b8db2650fd382c4762293b0390eda2587b
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/31/2025 7:15:16 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/31/2025 03:15:15.807 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/31/2025 03:14:57.118 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=246
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.595.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\a89e63ca38e1a7ac0f607154e273a8b6d43d0cfd
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/31/2025 7:14:57 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/31/2025 03:14:56.726 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=245
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/31/2025 03:14:56.725 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=244
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xDB5DB5FB
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xF1C13334


_raw:
10/31/2025 03:14:56.724 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=243
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/31/2025 03:14:56.251 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:14:56.251 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=241
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:14:50.419 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=248
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/31/2025 03:14:50.339 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=247
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.573.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\f628b3f28e20a16d9bb48b1094f7217b3fcdf98c
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/31/2025 7:14:50 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/31/2025 03:14:32.053 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-newengland-t3-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=228
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.573.0
 	Antispyware security intelligence version: 1.439.573.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T13:36:40Z
 	Antispyware security intelligence creation time: 2025-10-30T13:36:39Z
 	Last quick scan start time: 2025-10-31T08:17:27Z
 	Last quick scan end time: 2025-10-31T08:19:28Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:14:08.915 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-newengland-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=246
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.573.0
 	Antispyware security intelligence version: 1.439.573.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T13:36:40Z
 	Antispyware security intelligence creation time: 2025-10-30T13:36:39Z
 	Last quick scan start time: 2025-10-31T09:59:32Z
 	Last quick scan end time: 2025-10-31T10:01:59Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:13:44.525 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=254
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\BddUpdateFailure = 0x0


_raw:
10/31/2025 03:13:44.525 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=253
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\DeltaUpdateFailure = 0x0


_raw:
10/31/2025 03:13:44.523 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=252
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/31/2025 03:13:44.522 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=251
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xDB5DB5FB
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xF1C13334


_raw:
10/31/2025 03:13:44.142 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=250
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:13:44.142 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=249
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:13:39.065 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=247
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.595.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\44fb7624f09b6d544f09ff6ecb7b051a51cef9f0
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/31/2025 7:13:39 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/31/2025 03:13:38.613 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=246
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/31/2025 03:13:38.612 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=245
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xDB5DB5FB
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xF1C13334


_raw:
10/31/2025 03:13:38.611 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=244
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/31/2025 03:13:38.132 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=243
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:13:38.132 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=242
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:13:35.550 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=238
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.595.0
 	Antispyware security intelligence version: 1.439.595.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-31T12:15:12Z
 	Antispyware security intelligence creation time: 2025-10-31T12:15:12Z
 	Last quick scan start time: 2025-10-31T06:30:55Z
 	Last quick scan end time: 2025-10-31T06:33:33Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:13:31.166 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=258
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.595.0
 	Antispyware security intelligence version: 1.439.595.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-31T12:15:12Z
 	Antispyware security intelligence creation time: 2025-10-31T12:15:12Z
 	Last quick scan start time: 2025-10-31T08:34:47Z
 	Last quick scan end time: 2025-10-31T08:37:01Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:12:53.120 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=228
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.573.0
 	Antispyware security intelligence version: 1.439.573.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T13:36:40Z
 	Antispyware security intelligence creation time: 2025-10-30T13:36:39Z
 	Last quick scan start time: 2025-10-31T09:12:20Z
 	Last quick scan end time: 2025-10-31T09:14:11Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:12:28.094 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=252
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\BddUpdateFailure = 0x0


_raw:
10/31/2025 03:12:28.094 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=251
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\DeltaUpdateFailure = 0x0


_raw:
10/31/2025 03:12:28.094 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=250
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\104 = 0x1


_raw:
10/31/2025 03:12:28.092 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=249
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/31/2025 03:12:28.091 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=248
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xDB5DB5FB
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xF1C13334


_raw:
10/31/2025 03:12:27.696 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=247
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:12:27.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=246
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:12:10.729 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t7-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=269
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.575.0
 	Antispyware security intelligence version: 1.439.575.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T15:36:06Z
 	Antispyware security intelligence creation time: 2025-10-30T15:36:06Z
 	Last quick scan start time: 2025-10-31T08:17:26Z
 	Last quick scan end time: 2025-10-31T08:18:54Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:11:38.901 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=233
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/31/2025 03:11:38.901 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=232
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xBAD69140
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xF1C13334


_raw:
10/31/2025 03:11:38.900 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=231
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/31/2025 03:11:38.890 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=230
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.595.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\1880ba3b50345e4c841bbdfc84586ace97985179
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/31/2025 7:11:38 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/31/2025 03:11:38.427 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=229
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:11:38.426 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=228
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:11:10.454 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=239
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\BddUpdateFailure = 0x0


_raw:
10/31/2025 03:11:10.454 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=238
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\DeltaUpdateFailure = 0x0


_raw:
10/31/2025 03:11:10.452 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=237
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/31/2025 03:11:10.451 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=236
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xBAD69140
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0xF1C13334


_raw:
10/31/2025 03:11:10.039 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=235
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:11:10.039 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=234
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.25090.3001


_raw:
10/31/2025 03:11:09.207 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=285
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.575.0
 	Antispyware security intelligence version: 1.439.575.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T15:36:06Z
 	Antispyware security intelligence creation time: 2025-10-30T15:36:06Z
 	Last quick scan start time: 2025-10-31T06:12:08Z
 	Last quick scan end time: 2025-10-31T06:13:52Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:11:05.302 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=269
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastSignatureUpdateResult = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastSignatureUpdateResult = 0x0


_raw:
10/31/2025 03:11:05.302 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=268
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x33799C70
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x19E51ABF


_raw:
10/31/2025 03:11:04.843 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=267
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
10/31/2025 03:11:04.843 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=266
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.595.0
 	Previous security intelligence Version: 1.439.573.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
10/31/2025 03:10:52.108 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t7-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=268
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.575.0
 	Antispyware security intelligence version: 1.439.575.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T15:36:06Z
 	Antispyware security intelligence creation time: 2025-10-30T15:36:06Z
 	Last quick scan start time: 2025-10-31T06:28:21Z
 	Last quick scan end time: 2025-10-31T06:29:49Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:10:42.651 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-newengland-t9-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=265
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.573.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25100.9002
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\a18a5348c1f312d24c96c4d983d7d99b44964227
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/31/2025 7:10:42 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/31/2025 03:10:28.741 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t7-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=269
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.575.0
 	Antispyware security intelligence version: 1.439.575.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T15:36:06Z
 	Antispyware security intelligence creation time: 2025-10-30T15:36:06Z
 	Last quick scan start time: 2025-10-31T06:24:05Z
 	Last quick scan end time: 2025-10-31T06:25:35Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/31/2025 03:10:19.875 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=277
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.575.0
 	Antispyware security intelligence version: 1.439.575.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1
 	Antispyware security intelligence age: 1
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-30T15:36:06Z
 	Antispyware security intelligence creation time: 2025-10-30T15:36:06Z
 	Last quick scan start time: 2025-10-31T06:29:44Z
 	Last quick scan end time: 2025-10-31T06:31:45Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000