_raw:
11/05/2025 07:28:59.863 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-410AIDJ88VF
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:28:46.881 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-53M770K4QOV
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw:
11/05/2025 07:28:46.881 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-53M770K4QOV
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:28:17.987 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-NO4OQ0ETBCI
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:28:17.987 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-NO4OQ0ETBCI
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:27:22.549 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-QLOQUJG9ETQ
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:27:22.549 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-QLOQUJG9ETQ
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:27:20.625 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-UGMHG9PQ5PU
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x3


_raw:
11/05/2025 07:27:20.625 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-UGMHG9PQ5PU
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampGradualRelease = 0x1


_raw:
11/05/2025 07:27:20.625 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-UGMHG9PQ5PU
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x3


_raw:
11/05/2025 07:27:16.297 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-UGMHG9PQ5PU
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:27:16.297 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-UGMHG9PQ5PU
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:25:52.270 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-CG3OA1TBSGH
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x3


_raw:
11/05/2025 07:25:52.270 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-CG3OA1TBSGH
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampGradualRelease = 0x1


_raw:
11/05/2025 07:25:52.270 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-CG3OA1TBSGH
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x3


_raw:
11/05/2025 07:25:48.255 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-CG3OA1TBSGH
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:25:48.255 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-CG3OA1TBSGH
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:25:30.314 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-PBDSKCJHKAN
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:25:30.314 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-PBDSKCJHKAN
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:24:11.428 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-PU2QM19GGBN
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2


_raw:
11/05/2025 07:24:11.428 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-PU2QM19GGBN
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2


_raw:
11/05/2025 07:24:07.178 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-PU2QM19GGBN
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:24:07.178 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-PU2QM19GGBN
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:23:26.995 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-8A6J5UTK5CP
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:23:26.995 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-8A6J5UTK5CP
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:23:16.880 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-FL1CLI1EKNO
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:23:16.880 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-FL1CLI1EKNO
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:21:10.564 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-NAC400VFOJP
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:21:10.564 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-NAC400VFOJP
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:21:03.985 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-I4PPCPTH9RC
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:21:03.985 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-I4PPCPTH9RC
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:19:40.877 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-J8NFGTB052A
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2


_raw:
11/05/2025 07:19:40.877 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-J8NFGTB052A
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2


_raw:
11/05/2025 07:19:36.799 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-J8NFGTB052A
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:19:36.799 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-J8NFGTB052A
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:19:29.892 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-S168MADI2JQ
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:19:29.892 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-S168MADI2JQ
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:18:52.104 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-TV1T9KC2TOI
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\7 = 0x1


_raw:
11/05/2025 07:18:47.766 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-TV1T9KC2TOI
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:18:47.766 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-TV1T9KC2TOI
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:18:29.819 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-3T2S2SP9VBG
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:18:29.819 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-3T2S2SP9VBG
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:18:21.445 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-LOQ1271EUG8
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2


_raw:
11/05/2025 07:18:21.445 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-LOQ1271EUG8
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2


_raw:
11/05/2025 07:18:21.444 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-LOQ1271EUG8
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\7 = 0x1


_raw:
11/05/2025 07:18:17.399 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-LOQ1271EUG8
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:18:17.399 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-LOQ1271EUG8
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:17:50.166 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-4F71DJUTIR7
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:17:50.166 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-4F71DJUTIR7
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:16:29.235 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-VHG5DL5IRJK
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x3


_raw:
11/05/2025 07:16:29.235 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-VHG5DL5IRJK
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampGradualRelease = 0x1


_raw:
11/05/2025 07:16:29.235 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-VHG5DL5IRJK
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x3


_raw:
11/05/2025 07:16:25.380 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-VHG5DL5IRJK
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:16:25.380 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-VHG5DL5IRJK
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:13:20.879 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-590B2MPB2TD
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\7 = 0x1


_raw:
11/05/2025 07:13:17.027 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-590B2MPB2TD
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:13:17.027 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-590B2MPB2TD
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 07:13:06.411 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-KVO2QCQGN4K
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 07:13:06.411 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-KVO2QCQGN4K
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 06:55:20.313 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-NCETAI60KIC
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 06:55:20.313 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-NCETAI60KIC
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 06:54:13.729 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-C61HV57FNHL
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 06:54:13.729 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-C61HV57FNHL
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 06:53:51.770 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-LJNH93KQ1E5
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 06:53:51.770 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-LJNH93KQ1E5
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 06:53:15.264 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-JHSAAJTFUM6
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2


_raw:
11/05/2025 06:53:15.264 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-JHSAAJTFUM6
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2


_raw:
11/05/2025 06:53:15.264 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-JHSAAJTFUM6
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\7 = 0x1


_raw:
11/05/2025 06:53:11.386 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-JHSAAJTFUM6
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 06:53:11.386 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-JHSAAJTFUM6
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 06:52:44.630 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-A4I6S7O9QD2
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2


_raw:
11/05/2025 06:52:44.630 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-A4I6S7O9QD2
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2


_raw:
11/05/2025 06:52:40.405 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-A4I6S7O9QD2
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 06:52:40.405 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-A4I6S7O9QD2
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 06:51:46.343 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-0HAMGSCES4R
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 06:51:46.343 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-0HAMGSCES4R
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 06:51:10.905 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-7659SDQ0K3P
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 06:51:10.905 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-7659SDQ0K3P
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 06:50:53.076 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-FQ21L2J8N6N
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 06:50:53.076 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-FQ21L2J8N6N
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 06:50:39.552 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-BMURMM7ANJ2
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 06:50:39.552 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-BMURMM7ANJ2
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 06:50:09.815 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=33
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 06:50:04.674 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 06:50:04.674 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 06:49:31.906 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-7EFAE9APF8L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 06:48:39.170 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2001
EventType=2
ComputerName=WIN-7EFAE9APF8L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Error
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
 	New security intelligence Version:
 	Previous security intelligence Version: 1.321.69.0
 	Update Source: Microsoft Malware Protection Center
 	Security intelligence Type: AntiVirus
 	Update Type: Full
 	User: NT AUTHORITY\NETWORK SERVICE
 	Current Engine Version:
 	Previous Engine Version: 1.1.17300.4
 	Error code: 0x80072ee7
 	Error description: The server name or address could not be resolved


_raw:
11/05/2025 06:48:39.169 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2001
EventType=2
ComputerName=WIN-7EFAE9APF8L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Error
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
 	New security intelligence Version:
 	Previous security intelligence Version: 1.321.69.0
 	Update Source: Microsoft Malware Protection Center
 	Security intelligence Type: AntiSpyware
 	Update Type: Full
 	User: NT AUTHORITY\NETWORK SERVICE
 	Current Engine Version:
 	Previous Engine Version: 1.1.17300.4
 	Error code: 0x80072ee7
 	Error description: The server name or address could not be resolved


_raw:
11/05/2025 06:48:39.169 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2001
EventType=2
ComputerName=WIN-7EFAE9APF8L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Error
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
 	New security intelligence Version:
 	Previous security intelligence Version: 1.321.69.0
 	Update Source: Microsoft Malware Protection Center
 	Security intelligence Type: AntiVirus
 	Update Type: Full
 	User: NT AUTHORITY\NETWORK SERVICE
 	Current Engine Version:
 	Previous Engine Version: 1.1.17300.4
 	Error code: 0x80072ee7
 	Error description: The server name or address could not be resolved


_raw:
11/05/2025 06:48:39.164 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2001
EventType=2
ComputerName=WIN-7EFAE9APF8L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Error
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
 	New security intelligence Version:
 	Previous security intelligence Version: 1.321.69.0
 	Update Source: Microsoft Malware Protection Center
 	Security intelligence Type: AntiVirus
 	Update Type: Full
 	User: NT AUTHORITY\NETWORK SERVICE
 	Current Engine Version:
 	Previous Engine Version: 1.1.17300.4
 	Error code: 0x80072ee7
 	Error description: The server name or address could not be resolved


_raw:
11/05/2025 06:48:39.163 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2001
EventType=2
ComputerName=WIN-7EFAE9APF8L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Error
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
 	New security intelligence Version:
 	Previous security intelligence Version: 1.321.69.0
 	Update Source: Microsoft Malware Protection Center
 	Security intelligence Type: AntiSpyware
 	Update Type: Full
 	User: NT AUTHORITY\NETWORK SERVICE
 	Current Engine Version:
 	Previous Engine Version: 1.1.17300.4
 	Error code: 0x80072ee7
 	Error description: The server name or address could not be resolved


_raw:
11/05/2025 06:48:39.163 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2001
EventType=2
ComputerName=WIN-7EFAE9APF8L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Error
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
 	New security intelligence Version:
 	Previous security intelligence Version: 1.321.69.0
 	Update Source: Microsoft Malware Protection Center
 	Security intelligence Type: AntiVirus
 	Update Type: Full
 	User: NT AUTHORITY\NETWORK SERVICE
 	Current Engine Version:
 	Previous Engine Version: 1.1.17300.4
 	Error code: 0x80072ee7
 	Error description: The server name or address could not be resolved


_raw:
11/05/2025 06:48:39.047 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2001
EventType=2
ComputerName=WIN-7EFAE9APF8L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Error
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
 	New security intelligence Version:
 	Previous security intelligence Version: 1.321.69.0
 	Update Source: Microsoft Update Server
 	Security intelligence Type: AntiVirus
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version:
 	Previous Engine Version: 1.1.17300.4
 	Error code: 0x8024402c
 	Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.


_raw:
11/05/2025 06:48:36.485 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-7EFAE9APF8L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x3


_raw:
11/05/2025 06:48:36.485 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-7EFAE9APF8L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampGradualRelease = 0x1


_raw:
11/05/2025 06:48:36.485 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-7EFAE9APF8L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x3


_raw:
11/05/2025 06:48:31.857 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-7EFAE9APF8L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 06:48:31.857 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-7EFAE9APF8L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:39:20.718 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-PP4D6BSAR3E
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:39:20.718 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-PP4D6BSAR3E
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:38:57.849 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-ISLHKF0I5AV
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:38:57.849 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-ISLHKF0I5AV
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:37:44.575 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-C278RFK77HJ
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:37:44.575 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-C278RFK77HJ
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:37:31.229 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-GHQS6B3CF59
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:37:31.229 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-GHQS6B3CF59
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:36:26.017 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-KFP6STFOHPO
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:36:26.017 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-KFP6STFOHPO
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:33:07.826 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-C7JEDC1KDP0
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2


_raw:
11/05/2025 05:33:07.826 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-C7JEDC1KDP0
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2


_raw:
11/05/2025 05:33:03.383 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-C7JEDC1KDP0
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:33:03.383 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-C7JEDC1KDP0
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:32:38.550 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-DJ1K6TS6QOS
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:32:38.550 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-DJ1K6TS6QOS
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:32:24.845 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-BVFT61F93A6
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:32:24.845 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-BVFT61F93A6
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:31:47.597 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-S3IB1GAD20M
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:31:47.596 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-S3IB1GAD20M
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:31:41.317 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-2C89FEQF1FD
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x3


_raw:
11/05/2025 05:31:41.317 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-2C89FEQF1FD
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampGradualRelease = 0x1


_raw:
11/05/2025 05:31:41.317 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-2C89FEQF1FD
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x3


_raw:
11/05/2025 05:31:40.155 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-OUNL747D76L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:31:40.155 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-OUNL747D76L
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:31:37.350 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-2C89FEQF1FD
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:31:37.350 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-2C89FEQF1FD
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:29:18.925 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-IEKFQ5I8V1J
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x3


_raw:
11/05/2025 05:29:18.925 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-IEKFQ5I8V1J
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampGradualRelease = 0x1


_raw:
11/05/2025 05:29:18.925 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-IEKFQ5I8V1J
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x3


_raw:
11/05/2025 05:29:16.462 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-NQR28JAGPRF
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:29:16.462 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-NQR28JAGPRF
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:29:14.845 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-IEKFQ5I8V1J
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:29:14.845 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-IEKFQ5I8V1J
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:28:30.700 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-SQTHPJ6FPLN
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:28:30.700 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-SQTHPJ6FPLN
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:26:18.454 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-F8D5L0U1J8B
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:26:18.454 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-F8D5L0U1J8B
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:26:02.181 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-OCR6NQG05OT
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2


_raw:
11/05/2025 05:26:02.181 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-OCR6NQG05OT
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2


_raw:
11/05/2025 05:25:58.475 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-OCR6NQG05OT
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:25:58.475 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-OCR6NQG05OT
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:25:08.249 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-DOHG0ECU2L0
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:25:08.249 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-DOHG0ECU2L0
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:24:50.832 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-7JO4MEKBKID
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:24:50.832 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-7JO4MEKBKID
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:24:41.785 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-383OU0IMGG7
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:24:41.785 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-383OU0IMGG7
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:24:16.926 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-473GPO6VD97
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:24:16.926 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-473GPO6VD97
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:21:22.719 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-3QDLR7MJ1KE
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:21:22.719 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-3QDLR7MJ1KE
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:21:13.954 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-GJVR0ME71OJ
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:21:13.954 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-GJVR0ME71OJ
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:20:18.332 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-IT1AU0MK1BB
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:20:18.332 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-IT1AU0MK1BB
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:18:52.721 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-I1EF5CG3DI3
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2


_raw:
11/05/2025 05:18:52.721 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-I1EF5CG3DI3
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2


_raw:
11/05/2025 05:18:48.784 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-I1EF5CG3DI3
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:18:48.784 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-I1EF5CG3DI3
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:18:33.018 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-N0FUE86V9DM
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2


_raw:
11/05/2025 05:18:33.018 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-N0FUE86V9DM
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2


_raw:
11/05/2025 05:18:29.019 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-N0FUE86V9DM
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:18:29.019 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-N0FUE86V9DM
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:18:17.573 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-6U2KT6AQOE3
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:18:17.573 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-6U2KT6AQOE3
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 05:17:25.427 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-G0IAM7EU164
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 05:17:25.427 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-G0IAM7EU164
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1