2026-07-30T14:22:37.999 [RTP] No config change detected. Not updating plugin configuration.
2026-07-30T14:22:37.999 [RTP] No config changes found. No configuration switch.
2026-07-30T14:22:37.999 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0
2026-07-30T14:22:40.749 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T14:22:40.749 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T14:22:40.749 [Cloud] Queued cloud request.
2026-07-30T14:22:40.749 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T14:22:40.749 [Cloud] Dequeued cloud request.
2026-07-30T14:22:40.749 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T14:22:40.937 [Cloud] End of cloud request.
2026-07-30T14:22:41.437 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T14:23:03.765 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 28718, Count: 1253, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-07-30T14:23:03.765 ProcessImageName: AgentShell.exe, Pid: 4364, TotalTime: 22615, Count: 908, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-07-30T14:23:03.765 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 14743, Count: 735, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0%
2026-07-30T14:23:03.765 ProcessImageName: powershell.exe, Pid: 2976, TotalTime: 1775, Count: 90, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\000a53285985b0def7f9930691f067ae\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 43%
2026-07-30T14:23:03.765 ProcessImageName: php.exe, Pid: 9028, TotalTime: 1253, Count: 23, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 37%
2026-07-30T14:23:03.765 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1055, Count: 55, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-07-30T14:23:03.765 ProcessImageName: AgentShellService.exe, Pid: 7612, TotalTime: 993, Count: 24, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 53%
2026-07-30T14:23:03.765 ProcessImageName: WmiPrvSE.exe, Pid: 1044, TotalTime: 692, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 12%
2026-07-30T14:23:03.765 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 458, Count: 22, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-30T14:23:03.765 ProcessImageName: WmiPrvSE.exe, Pid: 272, TotalTime: 453, Count: 39, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 38%
2026-07-30T14:23:03.765 ProcessImageName: powershell.exe, Pid: 6788, TotalTime: 356, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 43%
2026-07-30T14:23:03.765 ProcessImageName: powershell.exe, Pid: 9116, TotalTime: 341, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 36%
2026-07-30T14:23:03.765 ProcessImageName: WmiPrvSE.exe, Pid: 1296, TotalTime: 278, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100%
2026-07-30T14:23:03.765 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 260, Count: 16, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-07-30T14:23:03.765 ProcessImageName: python.exe, Pid: 9020, TotalTime: 258, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 10%
2026-07-30T14:23:03.765 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 201, Count: 4, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-07-30T14:23:03.765 ProcessImageName: ngentask.exe, Pid: 6788, TotalTime: 198, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 40%
2026-07-30T14:23:03.765 ProcessImageName: cmd.exe, Pid: 8108, TotalTime: 171, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 84%
2026-07-30T14:23:03.765 ProcessImageName: ngentask.exe, Pid: 812, TotalTime: 168, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 51%
2026-07-30T14:23:03.765 ProcessImageName: ngentask.exe, Pid: 5200, TotalTime: 167, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 42%
2026-07-30T14:23:03.765 ProcessImageName: python.exe, Pid: 8104, TotalTime: 166, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\renewal.py, EstimatedImpact: 6%
2026-07-30T14:23:03.765 ProcessImageName: MEPOC.exe, Pid: 2796, TotalTime: 152, Count: 9, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\35080F72803349A4871D5DA894896DA2.MAI, EstimatedImpact: 88%
2026-07-30T14:23:03.765 ProcessImageName: ngentask.exe, Pid: 7400, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 50%
2026-07-30T14:23:03.765 ProcessImageName: DeviceCensus.exe, Pid: 8712, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8%
2026-07-30T14:23:03.765 ProcessImageName: taskhostw.exe, Pid: 6904, TotalTime: 76, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 14%
2026-07-30T14:23:03.765 ProcessImageName: cmd.exe, Pid: 6512, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0%
2026-07-30T14:23:03.765 ProcessImageName: powershell.exe, Pid: 7356, TotalTime: 46, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0%
2026-07-30T14:23:03.765 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 45, Count: 52, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2282-2.MAD, EstimatedImpact: 19%
2026-07-30T14:23:03.765 ProcessImageName: MEMTA.exe, Pid: 2784, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\9F732F1416ED410FAA411C660DF33AC8.MAI, EstimatedImpact: 0%
2026-07-30T14:23:03.765 ProcessImageName: mysqldump.exe, Pid: 6304, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 13%
2026-07-30T14:23:03.765 ProcessImageName: svchost.exe, Pid: 2532, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\DiagTrack\utc.allow.diffbase, EstimatedImpact: 0%
2026-07-30T14:23:03.765 ProcessImageName: AggregatorHost.exe, Pid: 4104, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0%
2026-07-30T14:23:03.765 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-07-30T14:23:08.140 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\33D82302-1E3C-434A-8324-B83D9CD228C61060.1dd202ef0050f04
2026-07-30T14:23:08.202 Verifying engine and signature files (source: 0) ...
2026-07-30T14:23:08.202 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DAC923FD-89A8-4286-AA88-929B417E73D7}\mpengine.dll] due to PPL.
2026-07-30T14:23:08.202 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DAC923FD-89A8-4286-AA88-929B417E73D7}\mpasbase.vdm]. File not in cache (0x1)
2026-07-30T14:23:09.171 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DAC923FD-89A8-4286-AA88-929B417E73D7}\mpasbase.vdm]
2026-07-30T14:23:09.171 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DAC923FD-89A8-4286-AA88-929B417E73D7}\mpasdlta.vdm]. File not in cache (0x1)
2026-07-30T14:23:09.202 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DAC923FD-89A8-4286-AA88-929B417E73D7}\mpasdlta.vdm]
2026-07-30T14:23:09.202 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DAC923FD-89A8-4286-AA88-929B417E73D7}\mpavbase.vdm]. File not in cache (0x1)
2026-07-30T14:23:09.702 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DAC923FD-89A8-4286-AA88-929B417E73D7}\mpavbase.vdm]
2026-07-30T14:23:09.702 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DAC923FD-89A8-4286-AA88-929B417E73D7}\mpavdlta.vdm]. File not in cache (0x1)
2026-07-30T14:23:09.718 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DAC923FD-89A8-4286-AA88-929B417E73D7}\mpavdlta.vdm]
2026-07-30T14:23:09.905 [Engine] IsHybridMode: 0
2026-07-30T14:23:09.905 [KSL]KSL(1.1.26051.3007) Is available via CAMP. KslDevice : KslD
2026-07-30T14:23:09.921 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-1EB240F147358CE9E6C8C3D9CF153F9AC22A6DE4.bin): 0x00000002
2026-07-30T14:23:09.921 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-1EB240F147358CE9E6C8C3D9CF153F9AC22A6DE4.bin)
2026-07-30T14:23:09.921 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0
2026-07-30T14:23:09.921 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0
2026-07-30T14:23:09.921 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0
2026-07-30T14:23:09.921 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff
IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b
IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b
IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b
IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b
IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d
IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b
IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d
IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b
2026-07-30T14:23:22.624 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
2026-07-30T14:23:22.640 [AutoExclusion] Applied roles from cache.
2026-07-30T14:23:22.640 [AutoExclusion] Started roles monitoring.
IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b
IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4
IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b
IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4
IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4
IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b
IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b
IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b
IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b
IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpFc_Kernel_DoNotResetExcludeOnModify hr=0x8007007b
IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse
IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0
IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse
2026-07-30T14:23:22.734 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFA3A758AF0, lRefCount: 6, hr=0
2026-07-30T14:23:22.734 [Engine] New active engine 00007FFA3B958AF0 replacing engine 00007FFA3A758AF0. Number of active engines: 2
2026-07-30T14:23:22.749 EngineInit:Global ASOC is enabled
2026-07-30T14:23:22.749 EngineInit:ASOO is enabled for developer volumes
2026-07-30T14:23:22.827 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100)
2026-07-30T14:23:22.827 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-30T14:23:22.827 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380)
2026-07-30T14:23:22.827 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380)
2026-07-30T14:23:22.827 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0)
2026-07-30T14:23:22.827 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-30T14:23:22.843 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-30T14:23:22.843 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-30T14:23:22.843 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0)
2026-07-30T14:23:22.843 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-30T14:23:22.843 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100)
2026-07-30T14:23:22.843 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-30T14:23:22.843 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-30T14:23:22.843 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-30T14:23:22.843 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-30T14:23:22.843 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-30T14:23:22.843 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-30T14:23:22.843 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-30T14:23:22.843 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-30T14:23:22.874 MpWriteUupSignatureVersion 1.455.426.0, hr = 0
2026-07-30T14:23:22.874 ForceSyncMoacInsertion config from engine is 0, hr = 0x0
2026-07-30T14:23:22.890 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit
2026-07-30T14:23:22.890 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0
2026-07-30T14:23:22.890 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)!
2026-07-30T14:23:22.890 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set.
2026-07-30T14:23:22.921 MpUpdateUpdateResiliencyConfiguration updated to 0
2026-07-30T14:23:22.921 [Plugin] Initializing RTP plugin state...
2026-07-30T14:23:22.921 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off.
2026-07-30T14:23:22.921 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DAC923FD-89A8-4286-AA88-929B417E73D7}
2026-07-30T14:23:22.921 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{956AAE3F-215A-4DA6-A6B6-DA45A74F042C}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{956AAE3F-215A-4DA6-A6B6-DA45A74F042C}\mpasbase.vdm in use, hr=0x80070020
2026-07-30T14:23:22.921 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A551DC4A-5057-4715-BE7B-910938B19B7F} removed
2026-07-30T14:23:22.921 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f
2026-07-30T14:23:22.921 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f
2026-07-30T14:23:22.921 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f
2026-07-30T14:23:22.921 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f
2026-07-30T14:23:22.921 MdCoreSvc is supported in this platform and OS
2026-07-30T14:23:22.921 [RTP] 
****************************RTP Perf Log***************************
RTP Start:‎07‎-‎29‎-‎2026 16:23:04
Last Perf:‎07‎-‎29‎-‎2026 16:23:03
First RTP Scan:‎07‎-‎29‎-‎2026 16:23:04
Plugin States:  AV:1  AS:1  RTP:1  OA:1  BM:1
Process Exclusions:
Path Exclusions:
Ext Exclusions:
Temp Exclusions:
Worker Threads:
  AM:14
  Async:4
Cache Flushes:
  RTP:1
System File Cache:
  Hits:1282
  Misses:7056
BM Queue:0,120,0
  Proc:0,29,0
  File:0,120,0
Plugin Queue:0,1,0
  Threat:0,0,0
  Susp:0,1,0
  Unknown:0,0,0
  Error:0,0,0
Request Queue:2,3,0
  SetEngine:1,1,0
  SetState:1,1,0
  SetUser:0,0,0
  Config:0,1,0
  ProcExcl:0,1,0
  FilterReload:0,0,0
  FilterUnload:0,0,0
MpFilter:
  Scans:7208439
  Pending:0
  RegSize:309472
  AsyncQNotif:0
  AsyncQMissed:0
  AsyncQTotalSent:872053392
  AsyncQCurrent:0
  BMFlags:40095
  ServiceMaj:0
  ServiceMin:0
  NumInstance:3
  TotalStreamCon:6441
  NTFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:376378
   TotalHits:2775554
   InstanceCacheInserts:5410
   InstanceCacheUpdates:0
   InstanceCacheDeletes:3892
   InstanceCacheHits:1476
   InstanceCacheMisses:105212
   InstanceCacheOverflows:0
  CSVFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:0
   TotalHits:0
   InstanceCacheInserts:0
   InstanceCacheUpdates:0
   InstanceCacheDeletes:0
   InstanceCacheHits:0
   InstanceCacheMisses:0
   InstanceCacheOverflows:0
  REFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:0
   TotalHits:0
   InstanceCacheInserts:0
   InstanceCacheUpdates:0
   InstanceCacheDeletes:0
   InstanceCacheHits:0
   InstanceCacheMisses:0
   InstanceCacheOverflows:0
  SyncProcessCreateDuration:5ms (7875/1449)
   Success: 1449, failures: 0 (last code: 0x0), timeouts: 0,  baddata: 0
 
**************************END RTP Perf Log*************************

 
 

Beginning quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Target:
Flags:131074
Start time:07-30-2026 14:23:22
Finished quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Result:0
End time:07-30-2026 14:23:22
2026-07-30T14:23:22.921 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0).
2026-07-30T14:23:22.921 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0
2026-07-30T14:23:22.921 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0
2026-07-30T14:23:22.937 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-07-30T14:23:22.937 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0).
2026-07-30T14:23:22.937 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
BmLoggingDisabled:MpDisableBmLogging not set.
2026-07-30T14:23:22.937 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f
2026-07-30T14:23:22.937 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f
2026-07-30T14:23:22.937 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f
2026-07-30T14:23:22.937 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f
2026-07-30T14:23:22.937 MdCoreSvc is supported in this platform and OS
Signature updated on 07-30-2026 14:23:22
Product Version: 4.18.26060.3008
Service Version: 4.18.26060.3008
Engine Version: 1.1.26060.3008
AS Signature Version: 1.455.426.0
AV Signature Version: 1.455.426.0
************************************************************
2026-07-30T14:23:22.937 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0
2026-07-30T14:23:22.937 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\33D82302-1E3C-434A-8324-B83D9CD228C61060.1dd202ef0050f04
2026-07-30T14:23:22.952 Process scan (postsignatureupdatescan) started.
2026-07-30T14:23:22.984 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True
2026-07-30T14:23:22.984 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0
Signature updated via MicrosoftUpdateServer on 07-30-2026 14:23:23
************************************************************
2026-07-30T14:23:23.124 Job Notification: Process exited from job (7088)
2026-07-30T14:23:23.124 Job Notification: Process exited from job (8584)
2026-07-30T14:23:23.140 Job Notification: Process exited from job (6496)
2026-07-30T14:23:23.155 Job Notification: Process exited from job (8428)
2026-07-30T14:23:23.280 [RTP] Setting RegLinkHardeningMode to 1 (hr=0).
2026-07-30T14:23:23.280 [RTP] Setting EfsHardeningFlags to 0 (hr=0).
2026-07-30T14:23:23.280 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0).
2026-07-30T14:23:23.280 [RTP] PreventPagingFileAbuseKillbit[0].
2026-07-30T14:23:23.280 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0).
2026-07-30T14:23:23.280 [Engine] Engine 00007FFA3A758AF0 no longer in use. Number of active engines: 1
2026-07-30T14:23:23.280 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-07-30T14:23:23.280 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0).
2026-07-30T14:23:23.405 [KSL] Entering CKSLEngine::EnableKSL. State: [3]
2026-07-30T14:23:23.405 [KSL] CKSLEngine::EnableKSL feature is already enabled.
2026-07-30T14:23:23.405 [KSL] Leaving CKSLEngine::EnableKsl(0).
2026-07-30T14:23:23.734 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 28764, Count: 1254, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-07-30T14:23:23.734 ProcessImageName: AgentShell.exe, Pid: 4364, TotalTime: 22615, Count: 908, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-07-30T14:23:23.734 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 14743, Count: 735, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0%
2026-07-30T14:23:23.734 ProcessImageName: powershell.exe, Pid: 2976, TotalTime: 1775, Count: 90, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\000a53285985b0def7f9930691f067ae\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 43%
2026-07-30T14:23:23.734 ProcessImageName: php.exe, Pid: 9028, TotalTime: 1253, Count: 23, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 37%
2026-07-30T14:23:23.734 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1055, Count: 55, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-07-30T14:23:23.734 ProcessImageName: AgentShellService.exe, Pid: 7612, TotalTime: 993, Count: 24, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 53%
2026-07-30T14:23:23.734 ProcessImageName: WmiPrvSE.exe, Pid: 1044, TotalTime: 692, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 12%
2026-07-30T14:23:23.734 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 458, Count: 22, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-30T14:23:23.734 ProcessImageName: WmiPrvSE.exe, Pid: 272, TotalTime: 453, Count: 39, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 38%
2026-07-30T14:23:23.734 ProcessImageName: powershell.exe, Pid: 6788, TotalTime: 356, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 43%
2026-07-30T14:23:23.734 ProcessImageName: powershell.exe, Pid: 9116, TotalTime: 341, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 36%
2026-07-30T14:23:23.734 ProcessImageName: WmiPrvSE.exe, Pid: 1296, TotalTime: 278, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100%
2026-07-30T14:23:23.734 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 260, Count: 16, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-07-30T14:23:23.734 ProcessImageName: python.exe, Pid: 9020, TotalTime: 258, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 10%
2026-07-30T14:23:23.804 [Engine] RSIG_UNLOADENGINE, 00007FFA3A758AF0, err=0x0
2026-07-30T14:23:23.827 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{956AAE3F-215A-4DA6-A6B6-DA45A74F042C} removed
2026-07-30T14:23:40.765 Process scan (postsignatureupdatescan) completed.
2026-07-30T14:28:22.796 [RbM] Setting Last known good engine candidate. hr = 0
2026-07-30T14:32:02.468 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T14:46:16.483 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T14:46:16.483 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T14:46:16.483 [Cloud] Queued cloud request.
2026-07-30T14:46:16.483 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T14:46:16.483 [Cloud] Dequeued cloud request.
2026-07-30T14:46:16.483 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T14:46:16.655 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{A050E13E-42FB-3C49-078F-10C7115419D3}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 14:46:16
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T14:46:17.171 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T14:47:07.468 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T14:50:26.983 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T14:50:26.983 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T14:50:26.983 [Cloud] Queued cloud request.
2026-07-30T14:50:26.983 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T14:50:26.983 [Cloud] Dequeued cloud request.
2026-07-30T14:50:26.983 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T14:50:27.171 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{AC0473EE-42D5-80CA-5F40-55D7D3FBE0A7}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 14:50:27
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T14:50:27.686 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T14:53:29.967 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T14:53:29.967 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T14:53:29.967 [Cloud] Queued cloud request.
2026-07-30T14:53:29.967 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T14:53:29.967 [Cloud] Dequeued cloud request.
2026-07-30T14:53:29.967 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T14:53:30.108 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{60CDF0FC-03B2-4630-6C0E-76E43C65CA05}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 14:53:30
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T14:53:30.608 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T14:59:11.795 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T14:59:11.795 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T14:59:11.795 [Cloud] Queued cloud request.
2026-07-30T14:59:11.795 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T14:59:11.795 [Cloud] Dequeued cloud request.
2026-07-30T14:59:11.795 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T14:59:12.030 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{DC6B3FD3-D30C-9B9F-C133-67119D493A2D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 14:59:12
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T14:59:12.545 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T15:02:12.467 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T15:06:07.577 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T15:06:07.577 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T15:06:07.577 [Cloud] Queued cloud request.
2026-07-30T15:06:07.577 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T15:06:07.577 [Cloud] Dequeued cloud request.
2026-07-30T15:06:07.577 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T15:06:07.780 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{99B30E07-F4BD-BAB9-40D2-C3E1639E4271}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 15:06:07
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T15:06:08.295 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T15:07:38.639 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T15:07:38.639 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T15:07:38.639 [Cloud] Queued cloud request.
2026-07-30T15:07:38.639 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T15:07:38.639 [Cloud] Dequeued cloud request.
2026-07-30T15:07:38.639 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T15:07:38.827 [Cloud] End of cloud request.
2026-07-30T15:07:39.327 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T15:10:11.326 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T15:10:11.326 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T15:10:11.326 [Cloud] Queued cloud request.
2026-07-30T15:10:11.326 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T15:10:11.326 [Cloud] Dequeued cloud request.
2026-07-30T15:10:11.326 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T15:10:11.498 [Cloud] End of cloud request.
2026-07-30T15:10:11.998 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T15:12:02.530 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T15:12:02.530 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T15:12:02.530 [Cloud] Queued cloud request.
2026-07-30T15:12:02.530 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T15:12:02.530 [Cloud] Dequeued cloud request.
2026-07-30T15:12:02.545 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T15:12:02.670 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{116A506E-B790-EC2A-CED1-7AF060C21D32}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 15:12:02
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T15:12:03.170 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T15:16:19.483 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T15:16:19.483 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T15:16:19.483 [Cloud] Queued cloud request.
2026-07-30T15:16:19.483 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T15:16:19.483 [Cloud] Dequeued cloud request.
2026-07-30T15:16:19.483 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T15:16:19.701 [Cloud] End of cloud request.
2026-07-30T15:16:20.217 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T15:16:52.701 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T15:16:52.701 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T15:16:52.701 [Cloud] Queued cloud request.
2026-07-30T15:16:52.701 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T15:16:52.701 [Cloud] Dequeued cloud request.
2026-07-30T15:16:52.701 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T15:16:52.780 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F68E08E3-8B65-2DC0-99B8-A242D884C2ED}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 15:16:52
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T15:16:53.295 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T15:17:17.467 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T15:19:58.498 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T15:19:58.498 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T15:19:58.498 [Cloud] Queued cloud request.
2026-07-30T15:19:58.498 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T15:19:58.498 [Cloud] Dequeued cloud request.
2026-07-30T15:19:58.498 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T15:19:58.717 [Cloud] End of cloud request.
2026-07-30T15:19:59.217 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T15:21:20.748 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T15:21:20.748 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T15:21:20.748 [Cloud] Queued cloud request.
2026-07-30T15:21:20.748 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T15:21:20.748 [Cloud] Dequeued cloud request.
2026-07-30T15:21:20.748 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T15:21:20.951 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F44D0CB5-D739-8EC5-C8AC-FF7FB30AA45C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 15:21:20
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T15:21:21.451 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T15:32:22.467 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T15:32:55.904 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T15:32:55.904 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T15:32:55.904 [Cloud] Queued cloud request.
2026-07-30T15:32:55.904 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T15:32:55.904 [Cloud] Dequeued cloud request.
2026-07-30T15:32:55.904 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T15:32:56.092 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F71BB722-BA60-9068-B70F-7107092F43D6}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 15:32:56
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T15:32:56.607 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T15:35:38.482 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T15:35:38.482 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T15:35:38.482 [Cloud] Queued cloud request.
2026-07-30T15:35:38.482 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T15:35:38.482 [Cloud] Dequeued cloud request.
2026-07-30T15:35:38.482 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T15:35:38.670 [Cloud] End of cloud request.
2026-07-30T15:35:39.170 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T15:47:24.435 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T15:47:24.435 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T15:47:24.435 [Cloud] Queued cloud request.
2026-07-30T15:47:24.435 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T15:47:24.435 [Cloud] Dequeued cloud request.
2026-07-30T15:47:24.451 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T15:47:24.638 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{D87D524B-46C4-7229-3203-D25E0A0AF965}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 15:47:24
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T15:47:25.138 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T15:47:27.467 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T15:53:01.388 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T15:53:01.388 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T15:53:01.388 [Cloud] Queued cloud request.
2026-07-30T15:53:01.388 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T15:53:01.388 [Cloud] Dequeued cloud request.
2026-07-30T15:53:01.388 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T15:53:01.576 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{C46C23E2-203F-C10A-8695-E9842A0C9E41}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 15:53:01
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T15:53:02.092 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T16:02:32.467 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T16:06:43.841 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T16:06:43.841 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T16:06:43.841 [Cloud] Queued cloud request.
2026-07-30T16:06:43.841 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T16:06:43.841 [Cloud] Dequeued cloud request.
2026-07-30T16:06:43.841 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T16:06:44.044 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{6CBA40D0-ED6E-F6A3-D313-13D977336DE5}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 16:06:44
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T16:06:44.560 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T16:17:37.466 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T16:23:22.732 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 4121, Count: 178, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-07-30T16:23:22.732 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 1666, Count: 69, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_noframes.html, EstimatedImpact: 0%
2026-07-30T16:23:22.732 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-07-30T16:23:22.732 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start->(UTF-16LE), EstimatedImpact: 0%
2026-07-30T16:32:42.466 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T16:47:47.466 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T17:02:52.466 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T17:17:57.466 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T17:33:02.465 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T17:40:29.684 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T17:40:29.684 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T17:40:29.684 [Cloud] Queued cloud request.
2026-07-30T17:40:29.684 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T17:40:29.684 [Cloud] Dequeued cloud request.
2026-07-30T17:40:29.684 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T17:40:29.871 [Cloud] End of cloud request.
2026-07-30T17:40:30.371 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T17:45:14.231 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T17:45:14.231 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T17:45:14.231 [Cloud] Queued cloud request.
2026-07-30T17:45:14.231 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T17:45:14.231 [Cloud] Dequeued cloud request.
2026-07-30T17:45:14.231 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T17:45:14.434 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{5CBC9963-F05B-176B-F120-E4C65EDB3AD3}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 17:45:14
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T17:45:14.949 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T17:48:07.465 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T17:59:16.824 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T17:59:16.824 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T17:59:16.824 [Cloud] Queued cloud request.
2026-07-30T17:59:16.824 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T17:59:16.824 [Cloud] Dequeued cloud request.
2026-07-30T17:59:16.840 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T17:59:16.980 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{61048D8A-AE40-19F4-1413-18F481F35F7C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 17:59:16
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T17:59:17.496 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T18:03:12.465 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T18:03:26.746 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T18:03:26.746 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T18:03:26.746 [Cloud] Queued cloud request.
2026-07-30T18:03:26.746 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T18:03:26.746 [Cloud] Dequeued cloud request.
2026-07-30T18:03:26.746 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T18:03:27.230 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2BF21B94-7600-B438-41D2-CD115BB91EFC}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 18:03:27
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T18:03:27.746 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T18:03:34.230 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T18:03:34.230 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T18:03:34.230 [Cloud] Queued cloud request.
2026-07-30T18:03:34.230 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T18:03:34.230 [Cloud] Dequeued cloud request.
2026-07-30T18:03:34.230 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T18:03:34.340 [Cloud] End of cloud request.
2026-07-30T18:03:34.840 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T18:08:34.574 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T18:08:34.574 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T18:08:34.574 [Cloud] Queued cloud request.
2026-07-30T18:08:34.574 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T18:08:34.574 [Cloud] Dequeued cloud request.
2026-07-30T18:08:34.574 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T18:08:34.730 [Cloud] End of cloud request.
2026-07-30T18:08:35.230 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T18:10:56.761 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T18:10:56.761 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T18:10:56.761 [Cloud] Queued cloud request.
2026-07-30T18:10:56.761 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T18:10:56.761 [Cloud] Dequeued cloud request.
2026-07-30T18:10:56.761 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T18:10:56.902 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{D823D879-F6B2-7A14-3142-3BFA24005A0A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 18:10:56
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T18:10:57.418 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T18:11:50.011 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T18:11:50.011 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T18:11:50.011 [Cloud] Queued cloud request.
2026-07-30T18:11:50.011 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T18:11:50.011 [Cloud] Dequeued cloud request.
2026-07-30T18:11:50.011 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T18:11:50.355 [Cloud] End of cloud request.
2026-07-30T18:11:50.871 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T18:18:17.464 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T18:21:39.183 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T18:21:39.183 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T18:21:39.183 [Cloud] Queued cloud request.
2026-07-30T18:21:39.183 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T18:21:39.183 [Cloud] Dequeued cloud request.
2026-07-30T18:21:39.183 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T18:21:39.339 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{3CE6F9F7-B8CC-1C7E-DCA7-C639A75766AA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 18:21:39
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T18:21:39.839 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T18:23:22.746 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 8335, Count: 354, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-07-30T18:23:22.746 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 3392, Count: 176, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0%
2026-07-30T18:23:22.746 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 138, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start->(UTF-16LE), EstimatedImpact: 0%
2026-07-30T18:23:22.746 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-07-30T18:23:22.746 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-30T18:23:22.746 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-07-30T18:25:22.246 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T18:25:22.246 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T18:25:22.246 [Cloud] Queued cloud request.
2026-07-30T18:25:22.246 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T18:25:22.246 [Cloud] Dequeued cloud request.
2026-07-30T18:25:22.246 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T18:25:22.418 [Cloud] End of cloud request.
2026-07-30T18:25:22.918 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T18:33:22.464 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T18:42:51.245 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T18:42:51.245 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T18:42:51.245 [Cloud] Queued cloud request.
2026-07-30T18:42:51.245 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T18:42:51.245 [Cloud] Dequeued cloud request.
2026-07-30T18:42:51.245 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T18:42:51.449 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{19318195-BFF0-FF4E-7DFA-C118F45744F3}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 18:42:51
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T18:42:51.933 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T18:44:25.027 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T18:44:25.027 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T18:44:25.027 [Cloud] Queued cloud request.
2026-07-30T18:44:25.027 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T18:44:25.027 [Cloud] Dequeued cloud request.
2026-07-30T18:44:25.027 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T18:44:25.214 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F05E865E-2718-B35E-2EC6-42869BD40781}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 18:44:25
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T18:44:25.730 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T18:48:27.464 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T18:54:03.026 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T18:54:03.026 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T18:54:03.026 [Cloud] Queued cloud request.
2026-07-30T18:54:03.026 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T18:54:03.026 [Cloud] Dequeued cloud request.
2026-07-30T18:54:03.026 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T18:54:03.198 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{472A044B-9778-C87F-4A31-97D333F3BE0F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 18:54:03
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T18:54:03.698 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T18:59:50.386 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T18:59:50.386 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T18:59:50.386 [Cloud] Queued cloud request.
2026-07-30T18:59:50.386 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T18:59:50.386 [Cloud] Dequeued cloud request.
2026-07-30T18:59:50.386 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T18:59:50.542 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4BE027B8-3247-5024-230F-7E8056367349}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 18:59:50
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T18:59:51.042 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T19:03:32.464 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T19:10:18.495 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T19:10:18.495 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T19:10:18.495 [Cloud] Queued cloud request.
2026-07-30T19:10:18.495 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T19:10:18.495 [Cloud] Dequeued cloud request.
2026-07-30T19:10:18.495 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T19:10:18.651 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{6B588B2E-DDDB-9448-F484-91F9C9E9BDDD}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 19:10:18
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T19:10:19.151 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T19:16:49.589 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T19:16:49.589 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T19:16:49.589 [Cloud] Queued cloud request.
2026-07-30T19:16:49.589 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T19:16:49.589 [Cloud] Dequeued cloud request.
2026-07-30T19:16:49.589 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T19:16:49.995 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{0BDC209D-26F5-1ECF-ED75-A882E69BAFFD}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 19:16:49
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T19:16:50.495 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T19:18:37.463 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T19:24:10.713 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T19:24:10.713 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T19:24:10.713 [Cloud] Queued cloud request.
2026-07-30T19:24:10.713 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T19:24:10.713 [Cloud] Dequeued cloud request.
2026-07-30T19:24:10.713 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T19:24:10.901 [Cloud] End of cloud request.
2026-07-30T19:24:11.401 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T19:26:04.729 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T19:26:04.729 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T19:26:04.729 [Cloud] Queued cloud request.
2026-07-30T19:26:04.729 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T19:26:04.745 [Cloud] Dequeued cloud request.
2026-07-30T19:26:04.745 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T19:26:04.932 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F32F4835-1742-3124-FBA8-4EADAA8571C9}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 19:26:04
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T19:26:05.448 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T19:27:17.182 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T19:27:17.182 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T19:27:17.182 [Cloud] Queued cloud request.
2026-07-30T19:27:17.182 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T19:27:17.182 [Cloud] Dequeued cloud request.
2026-07-30T19:27:17.182 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T19:27:17.370 [Cloud] End of cloud request.
2026-07-30T19:27:17.870 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T19:31:00.073 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T19:31:00.073 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T19:31:00.073 [Cloud] Queued cloud request.
2026-07-30T19:31:00.073 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T19:31:00.073 [Cloud] Dequeued cloud request.
2026-07-30T19:31:00.073 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T19:31:00.260 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{68EC0CC5-63D6-F9CC-F848-EBB7770EA383}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 19:31:00
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T19:31:00.776 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T19:33:42.463 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T19:40:34.525 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T19:40:34.525 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T19:40:34.525 [Cloud] Queued cloud request.
2026-07-30T19:40:34.525 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T19:40:34.525 [Cloud] Dequeued cloud request.
2026-07-30T19:40:34.525 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T19:40:34.682 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2E794BDC-7D91-A177-05D5-E4B68D32A98C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 19:40:34
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T19:40:35.182 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T19:42:23.854 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T19:42:23.854 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T19:42:23.854 [Cloud] Queued cloud request.
2026-07-30T19:42:23.854 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T19:42:23.854 [Cloud] Dequeued cloud request.
2026-07-30T19:42:23.854 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T19:42:24.010 [Cloud] End of cloud request.
2026-07-30T19:42:24.525 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T19:43:13.416 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T19:43:13.416 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T19:43:13.416 [Cloud] Queued cloud request.
2026-07-30T19:43:13.416 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T19:43:13.416 [Cloud] Dequeued cloud request.
2026-07-30T19:43:13.416 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T19:43:13.494 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{60E967F3-C3D3-45A6-5D6A-F8064F447335}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 19:43:13
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T19:43:14.010 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T19:48:47.463 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T19:56:53.838 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T19:56:53.838 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T19:56:53.838 [Cloud] Queued cloud request.
2026-07-30T19:56:53.838 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T19:56:53.838 [Cloud] Dequeued cloud request.
2026-07-30T19:56:53.838 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T19:56:53.994 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4F665574-0788-8E43-4AC3-C5110F64C5FD}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 19:56:54
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T19:56:54.494 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T19:57:28.088 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T19:57:28.088 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T19:57:28.088 [Cloud] Queued cloud request.
2026-07-30T19:57:28.088 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T19:57:28.088 [Cloud] Dequeued cloud request.
2026-07-30T19:57:28.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T19:57:28.166 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{37298AD4-8F09-1171-A732-43EA3414A1BB}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 19:57:28
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T19:57:28.666 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:00:07.337 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:00:07.337 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:00:07.337 [Cloud] Queued cloud request.
2026-07-30T20:00:07.337 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:00:07.337 [Cloud] Dequeued cloud request.
2026-07-30T20:00:07.337 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:00:07.494 [Cloud] End of cloud request.
2026-07-30T20:00:08.009 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:03:07.963 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:03:07.963 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:03:07.963 [Cloud] Queued cloud request.
2026-07-30T20:03:07.978 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:03:07.978 [Cloud] Dequeued cloud request.
2026-07-30T20:03:07.978 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:03:08.119 [Cloud] End of cloud request.
2026-07-30T20:03:08.634 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:03:52.463 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T20:05:51.025 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:05:51.025 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:05:51.025 [Cloud] Queued cloud request.
2026-07-30T20:05:51.025 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:05:51.025 [Cloud] Dequeued cloud request.
2026-07-30T20:05:51.025 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:05:51.181 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{88475C94-F94B-953E-14FB-84F391567301}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 20:05:51
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T20:05:51.681 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:07:40.900 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:07:40.900 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:07:40.900 [Cloud] Queued cloud request.
2026-07-30T20:07:40.900 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:07:40.900 [Cloud] Dequeued cloud request.
2026-07-30T20:07:40.900 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:07:41.056 [Cloud] End of cloud request.
2026-07-30T20:07:41.572 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:12:28.322 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:12:28.322 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:12:28.322 [Cloud] Queued cloud request.
2026-07-30T20:12:28.322 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:12:28.322 [Cloud] Dequeued cloud request.
2026-07-30T20:12:28.337 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:12:28.478 [Cloud] End of cloud request.
2026-07-30T20:12:28.978 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:12:34.212 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:12:34.212 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:12:34.212 [Cloud] Queued cloud request.
2026-07-30T20:12:34.212 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:12:34.212 [Cloud] Dequeued cloud request.
2026-07-30T20:12:34.212 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:12:34.306 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E9DA4AD1-04FB-058A-96E0-20CD7964EC72}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 20:12:34
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T20:12:34.822 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:12:39.900 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:12:39.900 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:12:39.900 [Cloud] Queued cloud request.
2026-07-30T20:12:39.900 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:12:39.900 [Cloud] Dequeued cloud request.
2026-07-30T20:12:39.900 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:12:39.978 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{309D80FA-052F-4AD3-E4D5-E7B23DD8B938}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 20:12:39
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T20:12:40.478 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:16:09.853 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:16:09.853 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:16:09.853 [Cloud] Queued cloud request.
2026-07-30T20:16:09.853 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:16:09.853 [Cloud] Dequeued cloud request.
2026-07-30T20:16:09.868 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:16:09.993 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{24F1B7F5-0C99-936E-A371-79DBC7824808}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 20:16:10
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T20:16:10.509 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:18:09.556 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:18:09.556 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:18:09.556 [Cloud] Queued cloud request.
2026-07-30T20:18:09.556 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:18:09.556 [Cloud] Dequeued cloud request.
2026-07-30T20:18:09.556 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:18:09.712 [Cloud] End of cloud request.
2026-07-30T20:18:10.228 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:18:57.462 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T20:21:20.478 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:21:20.478 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:21:20.478 [Cloud] Queued cloud request.
2026-07-30T20:21:20.478 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:21:20.478 [Cloud] Dequeued cloud request.
2026-07-30T20:21:20.478 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:21:20.899 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{C1F51F1A-BF34-A947-3666-697D50FC66C3}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 20:21:20
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T20:21:21.415 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:23:22.743 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 12618, Count: 526, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-07-30T20:23:22.743 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 4820, Count: 227, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0%
2026-07-30T20:23:22.743 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 245, Count: 10, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start->(UTF-16LE), EstimatedImpact: 0%
2026-07-30T20:23:22.743 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 184, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-30T20:23:22.743 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-07-30T20:23:22.743 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-07-30T20:30:27.212 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:30:27.212 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:30:27.212 [Cloud] Queued cloud request.
2026-07-30T20:30:27.212 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:30:27.212 [Cloud] Dequeued cloud request.
2026-07-30T20:30:27.212 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:30:27.368 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F29A1A24-FAE1-B24F-20D2-B46F928C0BE0}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 20:30:27
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T20:30:27.868 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:31:34.634 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:31:34.634 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:31:34.634 [Cloud] Queued cloud request.
2026-07-30T20:31:34.634 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:31:34.634 [Cloud] Dequeued cloud request.
2026-07-30T20:31:34.649 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:31:34.790 [Cloud] End of cloud request.
2026-07-30T20:31:35.305 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:34:02.462 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T20:35:21.430 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:35:21.430 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:35:21.430 [Cloud] Queued cloud request.
2026-07-30T20:35:21.430 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:35:21.430 [Cloud] Dequeued cloud request.
2026-07-30T20:35:21.430 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:35:21.602 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{D58E4460-ABEA-CD36-9929-9C9168EAB97F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 20:35:21
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T20:35:22.118 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:41:08.758 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:41:08.758 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:41:08.758 [Cloud] Queued cloud request.
2026-07-30T20:41:08.758 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:41:08.758 [Cloud] Dequeued cloud request.
2026-07-30T20:41:08.758 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:41:08.961 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9C4BF6FD-43C1-C872-9A35-EDA4A7E96B9D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 20:41:08
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T20:41:09.462 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:42:30.540 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:42:30.540 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:42:30.540 [Cloud] Queued cloud request.
2026-07-30T20:42:30.540 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:42:30.540 [Cloud] Dequeued cloud request.
2026-07-30T20:42:30.540 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:42:30.727 [Cloud] End of cloud request.
2026-07-30T20:42:31.243 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:43:57.383 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T20:43:57.383 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T20:43:57.383 [Cloud] Queued cloud request.
2026-07-30T20:43:57.383 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T20:43:57.383 [Cloud] Dequeued cloud request.
2026-07-30T20:43:57.383 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T20:43:57.571 [Cloud] End of cloud request.
2026-07-30T20:43:58.087 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T20:49:07.461 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T21:04:12.461 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T21:05:37.555 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T21:05:37.555 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T21:05:37.555 [Cloud] Queued cloud request.
2026-07-30T21:05:37.555 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T21:05:37.555 [Cloud] Dequeued cloud request.
2026-07-30T21:05:37.555 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T21:05:37.711 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{55FF83BB-053A-EBEA-FFAD-246112058FBB}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 21:05:37
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T21:05:38.227 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T21:08:33.992 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T21:08:33.992 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T21:08:33.992 [Cloud] Queued cloud request.
2026-07-30T21:08:33.992 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T21:08:33.992 [Cloud] Dequeued cloud request.
2026-07-30T21:08:34.008 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T21:08:34.149 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{A94C5AAB-ED1B-3F7D-4BAA-AAFC79B5FC6F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 21:08:34
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T21:08:34.649 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T21:14:30.742 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T21:14:30.742 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T21:14:30.742 [Cloud] Queued cloud request.
2026-07-30T21:14:30.742 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T21:14:30.742 [Cloud] Dequeued cloud request.
2026-07-30T21:14:30.742 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T21:14:30.883 [Cloud] End of cloud request.
2026-07-30T21:14:31.383 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T21:17:33.133 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T21:17:33.133 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T21:17:33.133 [Cloud] Queued cloud request.
2026-07-30T21:17:33.133 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T21:17:33.133 [Cloud] Dequeued cloud request.
2026-07-30T21:17:33.133 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T21:17:33.289 [Cloud] End of cloud request.
2026-07-30T21:17:33.789 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T21:19:17.461 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T21:24:17.648 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T21:24:17.648 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T21:24:17.648 [Cloud] Queued cloud request.
2026-07-30T21:24:17.648 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T21:24:17.648 [Cloud] Dequeued cloud request.
2026-07-30T21:24:17.648 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T21:24:17.820 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{CF836537-2ADA-802D-262B-0FC8938EDBD9}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 21:24:17
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T21:24:18.320 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T21:34:22.461 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T21:34:39.242 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T21:34:39.242 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T21:34:39.242 [Cloud] Queued cloud request.
2026-07-30T21:34:39.242 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T21:34:39.242 [Cloud] Dequeued cloud request.
2026-07-30T21:34:39.242 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T21:34:39.445 [Cloud] End of cloud request.
2026-07-30T21:34:39.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T21:34:39.445 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T21:34:39.445 [Cloud] Queued cloud request.
2026-07-30T21:34:39.445 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T21:34:39.445 [Cloud] Dequeued cloud request.
2026-07-30T21:34:39.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T21:34:39.523 [Cloud] End of cloud request.
2026-07-30T21:34:39.945 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T21:39:42.132 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T21:39:42.132 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T21:39:42.132 [Cloud] Queued cloud request.
2026-07-30T21:39:42.132 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T21:39:42.132 [Cloud] Dequeued cloud request.
2026-07-30T21:39:42.132 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T21:39:42.367 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E27934F5-6F6F-2170-0ED5-46885EEB7661}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 21:39:42
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T21:39:42.867 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T21:49:27.460 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T21:50:39.898 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T21:50:39.898 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T21:50:39.898 [Cloud] Queued cloud request.
2026-07-30T21:50:39.898 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T21:50:39.898 [Cloud] Dequeued cloud request.
2026-07-30T21:50:39.898 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T21:50:40.101 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{025D4297-E63D-2F85-6D5A-35AE0B92441A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 21:50:40
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T21:50:40.601 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T22:02:52.179 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T22:02:52.179 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T22:02:52.179 [Cloud] Queued cloud request.
2026-07-30T22:02:52.179 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T22:02:52.179 [Cloud] Dequeued cloud request.
2026-07-30T22:02:52.179 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T22:02:52.585 [Cloud] End of cloud request.
2026-07-30T22:02:53.085 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T22:04:32.460 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T22:07:28.663 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T22:07:28.663 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T22:07:28.663 [Cloud] Queued cloud request.
2026-07-30T22:07:28.663 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T22:07:28.663 [Cloud] Dequeued cloud request.
2026-07-30T22:07:28.663 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T22:07:28.851 [Cloud] End of cloud request.
2026-07-30T22:07:29.351 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T22:08:36.694 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T22:08:36.694 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T22:08:36.694 [Cloud] Queued cloud request.
2026-07-30T22:08:36.694 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T22:08:36.694 [Cloud] Dequeued cloud request.
2026-07-30T22:08:36.694 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T22:08:36.882 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{92226E3D-818E-9156-133E-D073FA62ED0F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 22:08:36
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T22:08:37.382 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T22:13:55.319 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\IDR_XML_DEFAULT_TRANSFORM[1]. Process: \Device\HarddiskVolume2\Windows\System32\taskhostw.exe, Status: 0xc0000001, State: 0, ScanRequest #7364133, FileId: 0x100000000c47ba, Reason: OnClose, IoStatusBlockForNewFile: 0x3, DesiredAccess:0x0, FileAttributes:0x2020, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-30T22:19:37.460 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T22:23:22.741 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 16794, Count: 697, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-07-30T22:23:22.741 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 8107, Count: 415, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0%
2026-07-30T22:23:22.741 ProcessImageName: powershell.exe, Pid: 6416, TotalTime: 1958, Count: 106, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 42%
2026-07-30T22:23:22.741 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 1378, Count: 52, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-07-30T22:23:22.741 ProcessImageName: AgentShellService.exe, Pid: 4956, TotalTime: 1037, Count: 31, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54%
2026-07-30T22:23:22.741 ProcessImageName: WmiPrvSE.exe, Pid: 7708, TotalTime: 861, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6%
2026-07-30T22:23:22.741 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 366, Count: 19, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start->(UTF-16LE), EstimatedImpact: 0%
2026-07-30T22:23:22.741 ProcessImageName: WmiPrvSE.exe, Pid: 5424, TotalTime: 356, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 0%
2026-07-30T22:23:22.741 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 214, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-30T22:23:22.741 ProcessImageName: ngentask.exe, Pid: 2428, TotalTime: 213, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 42%
2026-07-30T22:23:22.741 ProcessImageName: ngentask.exe, Pid: 7916, TotalTime: 166, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 37%
2026-07-30T22:23:22.741 ProcessImageName: ngentask.exe, Pid: 8056, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 43%
2026-07-30T22:23:22.741 ProcessImageName: ngentask.exe, Pid: 1972, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 34%
2026-07-30T22:23:22.741 ProcessImageName: taskhostw.exe, Pid: 6120, TotalTime: 93, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 15%
2026-07-30T22:23:22.741 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-07-30T22:23:22.741 ProcessImageName: powershell.exe, Pid: 3664, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp32E4.tmp, EstimatedImpact: 0%
2026-07-30T22:23:22.741 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-07-30T22:31:27.335 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T22:31:27.335 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T22:31:27.335 [Cloud] Queued cloud request.
2026-07-30T22:31:27.335 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T22:31:27.335 [Cloud] Dequeued cloud request.
2026-07-30T22:31:27.335 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T22:31:27.491 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{14074D4A-3EC8-C1B8-BEB0-6A23E27B0575}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 22:31:27
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T22:31:28.006 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T22:33:53.803 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T22:33:53.803 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T22:33:53.803 [Cloud] Queued cloud request.
2026-07-30T22:33:53.803 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T22:33:53.803 [Cloud] Dequeued cloud request.
2026-07-30T22:33:53.803 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T22:33:53.960 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{85D5A003-D03E-19B4-F873-484155EAA985}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 22:33:53
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T22:33:54.460 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T22:34:42.460 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T22:38:00.116 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T22:38:00.116 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T22:38:00.116 [Cloud] Queued cloud request.
2026-07-30T22:38:00.116 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T22:38:00.116 [Cloud] Dequeued cloud request.
2026-07-30T22:38:00.116 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T22:38:00.256 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{12C48AF8-9E3A-7AFC-FF63-9EA0D300625C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 22:38:00
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T22:38:00.772 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T22:45:38.975 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T22:45:38.975 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T22:45:38.975 [Cloud] Queued cloud request.
2026-07-30T22:45:38.975 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T22:45:38.975 [Cloud] Dequeued cloud request.
2026-07-30T22:45:38.975 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T22:45:39.178 [Cloud] End of cloud request.
2026-07-30T22:45:39.678 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T22:49:47.459 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T22:52:34.584 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T22:52:34.584 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T22:52:34.584 [Cloud] Queued cloud request.
2026-07-30T22:52:34.584 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T22:52:34.584 [Cloud] Dequeued cloud request.
2026-07-30T22:52:34.584 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T22:52:34.787 [Cloud] End of cloud request.
2026-07-30T22:52:35.287 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T23:03:57.662 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T23:03:57.662 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T23:03:57.662 [Cloud] Queued cloud request.
2026-07-30T23:03:57.662 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T23:03:57.678 [Cloud] Dequeued cloud request.
2026-07-30T23:03:57.678 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T23:03:57.881 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{45BC5314-495E-43D2-70E1-B8468C3EDF74}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 23:03:57
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T23:03:58.381 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T23:04:52.459 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T23:05:57.037 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T23:05:57.037 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T23:05:57.037 [Cloud] Queued cloud request.
2026-07-30T23:05:57.037 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T23:05:57.193 [Cloud] Dequeued cloud request.
2026-07-30T23:05:57.193 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T23:05:57.428 [Cloud] End of cloud request.
2026-07-30T23:05:57.928 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T23:07:55.271 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T23:07:55.271 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T23:07:55.271 [Cloud] Queued cloud request.
2026-07-30T23:07:55.271 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T23:07:55.271 [Cloud] Dequeued cloud request.
2026-07-30T23:07:55.287 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T23:07:55.459 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{47893CF8-48E1-373F-507B-E9F9D9EB6674}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 23:07:55
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T23:07:55.959 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T23:08:57.599 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T23:08:57.599 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T23:08:57.599 [Cloud] Queued cloud request.
2026-07-30T23:08:57.599 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T23:08:57.599 [Cloud] Dequeued cloud request.
2026-07-30T23:08:57.599 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T23:08:57.803 [Cloud] End of cloud request.
2026-07-30T23:08:58.303 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T23:11:14.318 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T23:11:14.318 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T23:11:14.318 [Cloud] Queued cloud request.
2026-07-30T23:11:14.318 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T23:11:14.318 [Cloud] Dequeued cloud request.
2026-07-30T23:11:14.318 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T23:11:14.506 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4EA021FF-5C25-B0A3-2041-D1946EB7AE28}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 23:11:14
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T23:11:15.021 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T23:11:31.006 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T23:11:31.006 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T23:11:31.006 [Cloud] Queued cloud request.
2026-07-30T23:11:31.006 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T23:11:31.006 [Cloud] Dequeued cloud request.
2026-07-30T23:11:31.006 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T23:11:31.099 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{8DEAC357-E9E1-9F0C-272E-91520C21363A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 23:11:31
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T23:11:31.615 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T23:12:59.818 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T23:12:59.818 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T23:12:59.818 [Cloud] Queued cloud request.
2026-07-30T23:12:59.818 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T23:12:59.818 [Cloud] Dequeued cloud request.
2026-07-30T23:12:59.818 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T23:12:59.990 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2F3B15C0-AB60-6DB5-B46F-CEDF475A77B4}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 23:13:00
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T23:13:00.490 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T23:16:14.287 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T23:16:14.287 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T23:16:14.287 [Cloud] Queued cloud request.
2026-07-30T23:16:14.287 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T23:16:14.287 [Cloud] Dequeued cloud request.
2026-07-30T23:16:14.521 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T23:16:14.724 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{048BA721-622A-525F-594C-E5FC781885C2}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 23:16:14
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T23:16:15.224 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T23:19:57.459 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T23:26:32.177 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T23:26:32.177 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T23:26:32.177 [Cloud] Queued cloud request.
2026-07-30T23:26:32.177 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T23:26:32.177 [Cloud] Dequeued cloud request.
2026-07-30T23:26:32.177 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T23:26:32.396 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{0A6FE578-ADBF-A3FF-0BE5-59EF80063E0D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 23:26:32
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T23:26:32.912 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T23:35:02.458 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T23:41:28.990 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T23:41:28.990 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T23:41:28.990 [Cloud] Queued cloud request.
2026-07-30T23:41:28.990 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T23:41:28.990 [Cloud] Dequeued cloud request.
2026-07-30T23:41:28.990 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T23:41:29.193 [Cloud] End of cloud request.
2026-07-30T23:41:29.708 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T23:46:28.302 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T23:46:28.302 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T23:46:28.302 [Cloud] Queued cloud request.
2026-07-30T23:46:28.302 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T23:46:28.302 [Cloud] Dequeued cloud request.
2026-07-30T23:46:28.302 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T23:46:28.489 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{0B4FB6CC-3308-BF86-7AAA-087092809F5F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 23:46:28
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T23:46:29.005 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T23:49:19.208 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T23:49:19.208 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T23:49:19.208 [Cloud] Queued cloud request.
2026-07-30T23:49:19.208 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T23:49:19.208 [Cloud] Dequeued cloud request.
2026-07-30T23:49:19.208 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T23:49:19.396 [Cloud] End of cloud request.
2026-07-30T23:49:19.896 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-30T23:50:07.458 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-30T23:53:13.771 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-30T23:53:13.771 [Cloud] Start of cloud request. Passive mode: 0
2026-07-30T23:53:13.771 [Cloud] Queued cloud request.
2026-07-30T23:53:13.771 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-30T23:53:13.771 [Cloud] Dequeued cloud request.
2026-07-30T23:53:13.771 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-30T23:53:13.943 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{BF9B8C42-E299-622B-D655-0D9F879ACA40}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-30-2026 23:53:13
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-30T23:53:14.443 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T00:05:12.458 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T00:13:18.910 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T00:13:18.910 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T00:13:18.910 [Cloud] Queued cloud request.
2026-07-31T00:13:18.910 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T00:13:18.910 [Cloud] Dequeued cloud request.
2026-07-31T00:13:18.925 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T00:13:19.066 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1D7488CF-BB35-7A63-2E7A-FFE7A351E54C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 00:13:19
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T00:13:19.566 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T00:13:20.003 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T00:13:20.003 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T00:13:20.003 [Cloud] Queued cloud request.
2026-07-31T00:13:20.003 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T00:13:20.003 [Cloud] Dequeued cloud request.
2026-07-31T00:13:20.003 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T00:13:20.097 [Cloud] End of cloud request.
2026-07-31T00:13:20.113 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T00:13:20.113 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T00:13:20.113 [Cloud] Queued cloud request.
2026-07-31T00:13:20.113 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T00:13:20.113 [Cloud] Dequeued cloud request.
2026-07-31T00:13:20.113 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T00:13:20.191 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F0FA62CC-5A81-0D37-2825-65432F629917}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 00:13:20
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry


BEGIN BM telemetry
GUID:{59581F0B-5629-A098-BC9C-4DACC26E697A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 00:13:20
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T00:13:20.597 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T00:15:16.800 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T00:15:16.800 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T00:15:16.800 [Cloud] Queued cloud request.
2026-07-31T00:15:16.800 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T00:15:16.800 [Cloud] Dequeued cloud request.
2026-07-31T00:15:16.800 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T00:15:16.957 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{D527C447-4088-8AD3-396F-D70FD985E6C1}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 00:15:16
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T00:15:17.472 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T00:19:12.706 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T00:19:12.706 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T00:19:12.706 [Cloud] Queued cloud request.
2026-07-31T00:19:12.706 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T00:19:12.706 [Cloud] Dequeued cloud request.
2026-07-31T00:19:12.706 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T00:19:12.847 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9E908D3B-987B-3393-848D-2F8CB7021F06}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 00:19:12
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T00:19:13.347 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T00:20:17.456 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T00:23:22.753 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 16794, Count: 697, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-07-31T00:23:22.753 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 8568, Count: 429, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0%
2026-07-31T00:23:22.753 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 5482, Count: 235, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-07-31T00:23:22.753 ProcessImageName: powershell.exe, Pid: 6416, TotalTime: 1958, Count: 106, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 42%
2026-07-31T00:23:22.753 ProcessImageName: AgentShellService.exe, Pid: 4956, TotalTime: 1037, Count: 31, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54%
2026-07-31T00:23:22.753 ProcessImageName: WmiPrvSE.exe, Pid: 7708, TotalTime: 861, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6%
2026-07-31T00:23:22.753 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 458, Count: 23, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start->(UTF-16LE), EstimatedImpact: 0%
2026-07-31T00:23:22.753 ProcessImageName: WmiPrvSE.exe, Pid: 5424, TotalTime: 356, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 0%
2026-07-31T00:23:22.753 ProcessImageName: python.exe, Pid: 8460, TotalTime: 272, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\renewal.py, EstimatedImpact: 10%
2026-07-31T00:23:22.753 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 229, Count: 11, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-31T00:23:22.753 ProcessImageName: ngentask.exe, Pid: 2428, TotalTime: 213, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 42%
2026-07-31T00:23:22.753 ProcessImageName: ngentask.exe, Pid: 7916, TotalTime: 166, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 37%
2026-07-31T00:23:22.753 ProcessImageName: ngentask.exe, Pid: 8056, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 43%
2026-07-31T00:23:22.753 ProcessImageName: ngentask.exe, Pid: 1972, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 34%
2026-07-31T00:23:22.753 ProcessImageName: taskhostw.exe, Pid: 6120, TotalTime: 93, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 15%
2026-07-31T00:23:22.753 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-07-31T00:23:22.753 ProcessImageName: powershell.exe, Pid: 3664, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp32E4.tmp, EstimatedImpact: 0%
2026-07-31T00:23:22.753 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-07-31T00:23:24.316 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T00:23:24.316 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T00:23:24.316 [Cloud] Queued cloud request.
2026-07-31T00:23:24.316 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T00:23:24.316 [Cloud] Dequeued cloud request.
2026-07-31T00:23:24.316 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T00:23:24.456 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{362C462C-E6E7-67A8-EFBC-C402FE38F68D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 00:23:24
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T00:23:24.956 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T00:27:05.269 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T00:27:05.269 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T00:27:05.269 [Cloud] Queued cloud request.
2026-07-31T00:27:05.269 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T00:27:05.269 [Cloud] Dequeued cloud request.
2026-07-31T00:27:05.269 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T00:27:05.456 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F5C59C6A-0418-77E6-E1EB-EC7E72D12FDF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 00:27:05
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T00:27:05.956 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T00:35:22.456 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T00:36:31.237 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T00:36:31.237 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T00:36:31.237 [Cloud] Queued cloud request.
2026-07-31T00:36:31.237 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T00:36:31.237 [Cloud] Dequeued cloud request.
2026-07-31T00:36:31.237 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T00:36:31.440 [Cloud] End of cloud request.
2026-07-31T00:36:31.956 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T00:43:04.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T00:43:04.097 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T00:43:04.097 [Cloud] Queued cloud request.
2026-07-31T00:43:04.097 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T00:43:04.097 [Cloud] Dequeued cloud request.
2026-07-31T00:43:04.097 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T00:43:04.284 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{A13DD1B4-8403-E51E-1E2B-255B8D718418}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 00:43:04
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T00:43:04.784 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T00:46:44.096 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:B171DF73-BD40-452D-9129-EF6E71B701E2, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1)
2026-07-31T00:46:44.096 Scheduled scan with Id B171DF73-BD40-452D-9129-EF6E71B701E2 configured CPU priority: normal (LowCpuPriority: 0)
2026-07-31T00:46:44.096 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build.
2026-07-31T00:46:44.096 [SFC] System file cache build is not needed (already completed)
2026-07-31T00:47:11.612 Engine:Triggered AR EMS scan

2026-07-31T00:47:11.612 Engine:EMS scan for process: lsass pid: 628, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.628 Engine:EMS scan for process: svchost pid: 744, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.643 Engine:EMS scan for process: svchost pid: 848, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.659 Engine:EMS scan for process: svchost pid: 916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.659 Engine:EMS scan for process: svchost pid: 988, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.675 Engine:EMS scan for process: svchost pid: 1008, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.675 Engine:EMS scan for process: svchost pid: 472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.690 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.690 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.706 Engine:EMS scan for process: svchost pid: 1104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.706 Engine:EMS scan for process: svchost pid: 1264, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.706 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.706 Engine:EMS scan for process: svchost pid: 1360, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.721 Engine:EMS scan for process: svchost pid: 1380, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.721 Engine:EMS scan for process: svchost pid: 1388, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.721 Engine:EMS scan for process: svchost pid: 1432, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.737 Engine:EMS scan for process: svchost pid: 1440, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.753 Engine:EMS scan for process: svchost pid: 1464, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.753 Engine:EMS scan for process: svchost pid: 1504, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.753 Engine:EMS scan for process: svchost pid: 1756, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.753 Engine:EMS scan for process: svchost pid: 1808, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.768 Engine:EMS scan for process: svchost pid: 1820, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.768 Engine:EMS scan for process: svchost pid: 1836, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.784 Engine:EMS scan for process: svchost pid: 1892, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.784 Engine:EMS scan for process: svchost pid: 1956, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.784 Engine:EMS scan for process: svchost pid: 2020, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.800 Engine:EMS scan for process: svchost pid: 2028, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.800 Engine:EMS scan for process: svchost pid: 1460, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.800 Engine:EMS scan for process: svchost pid: 1532, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.816 Engine:EMS scan for process: svchost pid: 2120, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.816 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.831 Engine:EMS scan for process: svchost pid: 2384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.831 Engine:EMS scan for process: svchost pid: 2496, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.846 Engine:EMS scan for process: svchost pid: 2512, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.846 Engine:EMS scan for process: svchost pid: 2532, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.862 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.862 Engine:EMS scan for process: svchost pid: 2560, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.878 Engine:EMS scan for process: svchost pid: 2620, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.878 Engine:EMS scan for process: svchost pid: 2632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.878 Engine:EMS scan for process: svchost pid: 2936, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.893 Engine:EMS scan for process: svchost pid: 3016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.909 Engine:EMS scan for process: svchost pid: 3056, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.909 Engine:EMS scan for process: svchost pid: 3128, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.909 Engine:EMS scan for process: svchost pid: 3176, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.909 Engine:EMS scan for process: svchost pid: 3236, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.925 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.925 Engine:EMS scan for process: svchost pid: 3364, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.940 Engine:EMS scan for process: svchost pid: 3184, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.940 Engine:EMS scan for process: dllhost pid: 4116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.956 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.956 Engine:EMS scan for process: svchost pid: 3432, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.971 Engine:EMS scan for process: svchost pid: 4860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.987 Engine:EMS scan for process: svchost pid: 1772, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:11.987 Engine:EMS scan for process: svchost pid: 1112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:12.003 Engine:EMS scan for process: svchost pid: 1496, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:12.018 Engine:EMS scan for process: svchost pid: 5320, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:12.034 Engine:EMS scan for process: svchost pid: 2444, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:12.050 Engine:EMS scan for process: svchost pid: 3068, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:12.050 Engine:EMS scan for process: svchost pid: 7360, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:12.065 Engine:EMS scan for process: svchost pid: 5256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-07-31T00:47:12.081 Engine:EMS scan for process: svchost pid: 1636, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
2026-07-31T00:47:58.018 QuickScan:ScanID:B171DF73-BD40-452D-9129-EF6E71B701E2: Quick scan finished with error 0
2026-07-31T00:47:58.065 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T00:47:58.065 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T00:47:58.065 [Cloud] Queued cloud request.
2026-07-31T00:47:58.065 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T00:47:58.065 [Cloud] Dequeued cloud request.
2026-07-31T00:47:58.065 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T00:47:58.206 [Cloud] End of cloud request.
2026-07-31T00:47:58.206 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xe6d2f6467ffffffe
2026-07-31T00:47:58.206 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xa719dd6a7ffffffe
2026-07-31T00:47:58.221 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xe6d2f6467ffffffe
2026-07-31T00:47:58.221 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xa719dd6a7ffffffe
2026-07-31T00:47:58.237 UnknownTelemetryScan triggered, type: 2 (1 - Unknown, 2- Lofi), flags: 0 (0 - Regular, 1 - MemScan), 2 resources, RtpIoavOnly: FALSE
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
2026-07-31T00:47:58.706 [RTP] [RtpConfig] Config change detected, type: 32
2026-07-31T00:47:58.706 [RTP] Duplicating the current plugin configuration object...
2026-07-31T00:47:58.706 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ...
2026-07-31T00:47:58.706 [RTP] Updating plugin configuration due to recent config changes (0x20) ...
2026-07-31T00:47:58.706 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-07-31T00:47:58.706 [RTP] No config change detected. Not updating plugin configuration.
2026-07-31T00:47:58.706 [RTP] No config changes found. No configuration switch.
2026-07-31T00:47:58.706 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0
2026-07-31T00:47:58.706 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
2026-07-31T00:48:03.675 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xe6d2f6467ffffffe
2026-07-31T00:48:03.675 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xa719dd6a7ffffffe
2026-07-31T00:48:03.675 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xe6d2f6467ffffffe
2026-07-31T00:48:03.675 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xa719dd6a7ffffffe
2026-07-31T00:48:03.721 [Cloud] SubmitReport(CMpUnknownSpyNetReportContext)
2026-07-31T00:48:03.721 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T00:48:03.721 [Cloud] Queued cloud request.
2026-07-31T00:48:03.721 [Cloud] Dequeued cloud request.
2026-07-31T00:48:03.721 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T00:48:03.768 [Cloud] MpEngineParseSpyNetResponse(). hr = 0
2026-07-31T00:48:03.768 [Cloud] End of cloud request.
2026-07-31T00:48:04.284 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T00:50:27.456 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T00:55:34.924 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T00:55:34.924 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T00:55:34.924 [Cloud] Queued cloud request.
2026-07-31T00:55:34.924 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T00:55:35.081 [Cloud] Dequeued cloud request.
2026-07-31T00:55:35.081 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T00:55:35.284 [Cloud] End of cloud request.
2026-07-31T00:55:35.784 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T00:57:41.737 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T00:57:41.737 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T00:57:41.737 [Cloud] Queued cloud request.
2026-07-31T00:57:41.737 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T00:57:41.737 [Cloud] Dequeued cloud request.
2026-07-31T00:57:41.752 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T00:57:41.940 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{986784BC-E85B-524E-A302-39D41778F348}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 00:57:41
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T00:57:42.440 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T01:00:01.362 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420801, FileId: 0xa0000000c47c2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.362 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420802, FileId: 0x2e000000037473, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.393 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420808, FileId: 0xc0000000c47c2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.393 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420807, FileId: 0x30000000037473, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.409 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420813, FileId: 0x32000000037473, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.409 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420814, FileId: 0xe0000000c47c2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.424 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420820, FileId: 0x100000000c47c2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.424 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420819, FileId: 0x34000000037473, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.440 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420825, FileId: 0x36000000037473, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.440 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420826, FileId: 0x120000000c47c2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.456 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420831, FileId: 0x140000000c47c2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.456 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420832, FileId: 0x38000000037473, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.471 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420837, FileId: 0x160000000c47c2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.471 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420838, FileId: 0x3a000000037473, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.487 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420844, FileId: 0x180000000c47c2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.487 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420843, FileId: 0x3c000000037473, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.487 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420850, FileId: 0x3e000000037473, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.487 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420849, FileId: 0x1a0000000c47c2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.502 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420856, FileId: 0x1c0000000c47c2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.502 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420855, FileId: 0x40000000037473, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.518 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420862, FileId: 0x42000000037473, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.518 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420861, FileId: 0x1e0000000c47c2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.549 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420868, FileId: 0x200000000c47c2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:00:01.549 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-23a3-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7420867, FileId: 0x44000000037473, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T01:05:32.455 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T01:10:01.221 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T01:10:01.221 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T01:10:01.221 [Cloud] Queued cloud request.
2026-07-31T01:10:01.221 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T01:10:01.221 [Cloud] Dequeued cloud request.
2026-07-31T01:10:01.221 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T01:10:01.752 [Cloud] End of cloud request.
2026-07-31T01:10:02.252 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T01:19:56.533 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T01:19:56.533 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T01:19:56.533 [Cloud] Queued cloud request.
2026-07-31T01:19:56.533 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T01:19:56.533 [Cloud] Dequeued cloud request.
2026-07-31T01:19:56.533 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T01:19:56.674 [Cloud] End of cloud request.
2026-07-31T01:19:57.190 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T01:20:37.455 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T01:22:14.627 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T01:22:14.627 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T01:22:14.627 [Cloud] Queued cloud request.
2026-07-31T01:22:14.627 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T01:22:14.627 [Cloud] Dequeued cloud request.
2026-07-31T01:22:14.627 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T01:22:14.815 [Cloud] End of cloud request.
2026-07-31T01:22:15.315 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T01:24:53.252 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T01:24:53.252 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T01:24:53.252 [Cloud] Queued cloud request.
2026-07-31T01:24:53.252 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T01:24:53.252 [Cloud] Dequeued cloud request.
2026-07-31T01:24:53.252 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T01:24:53.440 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9A4B584C-992C-473E-9C52-CFFCC39A14C6}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 01:24:53
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T01:24:53.955 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T01:29:21.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T01:29:21.643 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T01:29:21.643 [Cloud] Queued cloud request.
2026-07-31T01:29:21.643 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T01:29:21.643 [Cloud] Dequeued cloud request.
2026-07-31T01:29:21.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T01:29:21.830 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{91F4BBB5-4D1A-67C4-3223-073CBC7A339B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 01:29:21
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T01:29:22.330 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T01:35:42.456 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T01:45:11.925 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T01:45:11.925 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T01:45:11.925 [Cloud] Queued cloud request.
2026-07-31T01:45:11.925 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T01:45:11.925 [Cloud] Dequeued cloud request.
2026-07-31T01:45:11.925 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T01:45:12.097 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2E7E5FB7-9447-0C22-FD3D-CABA999CD85D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 01:45:12
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T01:45:12.597 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T01:46:47.815 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T01:46:47.815 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T01:46:47.815 [Cloud] Queued cloud request.
2026-07-31T01:46:47.815 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T01:46:47.815 [Cloud] Dequeued cloud request.
2026-07-31T01:46:47.815 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T01:46:47.972 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9609432F-FB1B-0E6F-733F-9CE0B2FC23AC}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 01:46:47
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T01:46:48.472 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T01:48:01.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T01:48:01.643 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T01:48:01.643 [Cloud] Queued cloud request.
2026-07-31T01:48:01.643 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T01:48:01.643 [Cloud] Dequeued cloud request.
2026-07-31T01:48:01.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T01:48:01.800 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{AE02C5C5-7442-AEA7-3F4B-25BFB28F23AF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 01:48:01
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T01:48:02.315 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T01:50:47.456 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T01:52:10.987 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T01:52:10.987 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T01:52:10.987 [Cloud] Queued cloud request.
2026-07-31T01:52:10.987 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T01:52:10.987 [Cloud] Dequeued cloud request.
2026-07-31T01:52:10.987 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{13DFA962-18D6-9A9E-633A-D12CFAB01584}
SignatureID:55744863128705
SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 01:52:15
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T01:52:21.081 [Cloud] End of cloud request.
2026-07-31T01:52:21.581 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T02:05:52.456 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T02:12:25.018 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set.
2026-07-31T02:12:25.018 [AutoPurge] Routine task for Cache Maintenance has started.
2026-07-31T02:12:25.018 [AutoPurge] Routine task for Cache Maintenance ...
2026-07-31T02:12:25.018 [AutoPurge] Routine task for MpSFCBuild ...
2026-07-31T02:12:25.018 [AutoPurge] MpCmIsBuildCompleted() - S_OK
2026-07-31T02:12:25.018 [AutoPurge] MpSignalMaintenanceMode ...
2026-07-31T02:12:25.127 EnsureProtectedFolderAcls(), hr = 0x0
2026-07-31T02:12:25.127 [AutoPurge] MpReinforceServiceAcls: 0
2026-07-31T02:12:25.143 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0
2026-07-31T02:12:25.304 [AutoPurge] Cleanup Routine tasks have started.
2026-07-31T02:12:25.330 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0)
2026-07-31T02:12:25.330 [AutoPurge] Purged 0 expired detection item(s) from a total of 0.
2026-07-31T02:12:25.330 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds)
Beginning quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Target:
Flags:65538
Start time:07-31-2026 02:12:25
Finished quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Result:0
End time:07-31-2026 02:12:25
2026-07-31T02:12:25.330 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ...
2026-07-31T02:12:25.330 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26060.3008-0 ...
2026-07-31T02:12:25.330 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26050.15-0 ...
2026-07-31T02:12:25.330 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26040.7-0 ...
2026-07-31T02:12:25.330 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ...
2026-07-31T02:12:25.330 [AutoPurge] Cleanup Routine tasks have ended.
2026-07-31T02:12:25.518 Job Notification: New process added to job (8184)
2026-07-31T02:12:25.533 Task(GetDeviceTicket -AccessKey 95427EC7-D990-E253-8924-257339507D98 ) launched as network service
2026-07-31T02:12:26.080 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\system32\mtf.dll", hr=0x0
2026-07-31T02:12:26.143 Job Notification: Process exited from job (8184)
2026-07-31T02:12:26.237 Engine:Setting original file name "comdlg32.dll" for "c:\windows\systemresources\comdlg32.dll.mun", hr=0x0
2026-07-31T02:12:26.330 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T02:12:26.330 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T02:12:26.330 [Cloud] Queued cloud request.
2026-07-31T02:12:26.330 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T02:12:26.330 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0
2026-07-31T02:12:26.330 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T02:12:26.330 [Cloud] Queued cloud request.
2026-07-31T02:12:26.330 [AutoPurge] Removing expired default signature package ...
2026-07-31T02:12:26.330 [Cloud] Dequeued cloud request.
2026-07-31T02:12:26.330 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T02:12:26.330 [Cloud] Dequeued cloud request.
2026-07-31T02:12:26.346 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T02:12:26.346 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0
2026-07-31T02:12:26.504 [Cloud] End of cloud request.
2026-07-31T02:12:26.565 [Cloud] MpEngineParseSpyNetResponse(). hr = 0
2026-07-31T02:12:26.565 [Cloud] End of cloud request.
2026-07-31T02:12:26.565 Job Notification: New process added to job (7412)
2026-07-31T02:12:26.846 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ...
2026-07-31T02:12:26.846 [RTP] [RtpConfig] Config change detected, type: 32
2026-07-31T02:12:26.846 [RTP] [RtpConfig] Config change detected, type: 2
2026-07-31T02:12:26.846 [RTP] [RtpConfig] Config change detected, type: 4096
2026-07-31T02:12:26.846 [RTP] [RtpConfig] Config change detected, type: 4
2026-07-31T02:12:26.846 [RTP] [RtpConfig] Config change detected, type: 8
2026-07-31T02:12:26.846 [RTP] [RtpConfig] Config change detected, type: 16
2026-07-31T02:12:26.846 [RTP] [RtpConfig] Config change detected, type: 1024
2026-07-31T02:12:26.846 [RTP] [RtpConfig] Config change detected, type: 2048
2026-07-31T02:12:26.846 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0).
2026-07-31T02:12:26.846 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0).
2026-07-31T02:12:26.846 [RTP] Setting FilterExperimentMode to 0 (hr=0).
2026-07-31T02:12:26.846 [RTP] Setting DisableDriverUnload to 1 (hr=0).
2026-07-31T02:12:26.846 [RTP] Setting RegLinkHardeningMode to 1 (hr=0).
2026-07-31T02:12:26.846 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0).
2026-07-31T02:12:26.846 [RTP] Setting EfsHardeningFlags to 0 (hr=0).
2026-07-31T02:12:26.846 [RTP] PreventPagingFileAbuseKillbit[0].
2026-07-31T02:12:26.846 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0).
2026-07-31T02:12:26.846 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0).
2026-07-31T02:12:26.846 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration.
2026-07-31T02:12:26.846 [RTP] [RtpConfig] Config change detected, type: 64
2026-07-31T02:12:26.862 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T02:12:26.862 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T02:12:26.862 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T02:12:26.862 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T02:12:26.862 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T02:12:27.221 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0
2026-07-31T02:12:27.504 Job Notification: Process exited from job (7412)
2026-07-31T02:12:27.518 Engine:Setting original file name "WerMgr" for "c:\windows\system32\wermgr.exe", hr=0x0
2026-07-31T02:12:27.549 [AutoPurge] Verification Routine tasks have ended.
2026-07-31T02:12:27.643 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0
2026-07-31T02:12:27.721 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpmodemx.dll", hr=0x0
2026-07-31T02:12:27.768 Engine:Setting original file name "msdt.exe" for "c:\windows\systemresources\msdt.exe.mun", hr=0x0
2026-07-31T02:12:28.174 Engine:Setting original file name "FIREWALLCONTROLPANEL.DLL" for "c:\windows\systemresources\firewallcontrolpanel.dll.mun", hr=0x0
2026-07-31T02:12:29.174 Engine:Setting original file name "Winlangdb.dll" for "c:\windows\winsxs\amd64_microsoft-windows-languagesdb-onecore_31bf3856ad364e35_10.0.20348.3451_none_13b6dc898b15fcbe\winlangdb.dll.mun", hr=0x0
2026-07-31T02:12:29.440 [RTP] Duplicating the current plugin configuration object...
2026-07-31T02:12:29.440 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ...
2026-07-31T02:12:29.440 [RTP] Updating plugin configuration due to recent config changes (0x43e) ...
2026-07-31T02:12:29.440 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-07-31T02:12:29.440 [RTP] Calling GenerateEngineConfigStruct (0x18) ...
2026-07-31T02:12:29.440 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218
2026-07-31T02:12:30.393 Engine:Setting original file name "d2d1" for "c:\windows\syswow64\d2d1.dll", hr=0x0
2026-07-31T02:12:31.049 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0
2026-07-31T02:12:31.205 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0
2026-07-31T02:12:31.830 Engine:Setting original file name "d2d1" for "c:\windows\system32\d2d1.dll", hr=0x0
2026-07-31T02:12:32.346 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\system32\mpg4decd.dll", hr=0x0
2026-07-31T02:12:32.346 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0
2026-07-31T02:12:33.112 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0
2026-07-31T02:12:33.768 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0
2026-07-31T02:12:34.034 Engine:Setting original file name "msdxm.ocx" for "c:\windows\syswow64\dxmasf.dll", hr=0x0
2026-07-31T02:12:34.549 Engine:Setting original file name "VCOMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcomp140_app.dll", hr=0x0
2026-07-31T02:12:36.143 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\syswow64\acgenral.dll", hr=0x0
2026-07-31T02:12:36.705 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\system32\servicingcommon.dll", hr=0x0
2026-07-31T02:12:37.518 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\system32\licensingwinrt.dll", hr=0x0
2026-07-31T02:12:38.565 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnsvr.exe", hr=0x0
2026-07-31T02:12:39.330 Engine:Setting original file name "ntkrnlmp.exe" for "c:\windows\winsxs\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.20348.5386_none_14ac9716e654f424\ntoskrnl.exe", hr=0x0
2026-07-31T02:12:40.674 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0
2026-07-31T02:12:40.690 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnlobby.dll", hr=0x0
2026-07-31T02:12:40.783 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0
2026-07-31T02:12:40.799 Engine:Setting original file name "gdi32" for "c:\windows\system32\gdi32full.dll", hr=0x0
2026-07-31T02:12:41.018 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\system32\winresume.exe", hr=0x0
2026-07-31T02:12:41.252 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0
2026-07-31T02:12:41.377 Engine:Setting original file name "setup" for "c:\programdata\package cache\{1de5e707-82da-4db6-b810-5d140cc4cbb3}\vc_redist.x64.exe", hr=0x0
2026-07-31T02:12:41.487 Engine:Setting original file name "mini_installer.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{56eb18f8-b008-4cbd-b6d2-8c97fe7e9062}\150.0.4078.105\microsoftedge_x64_150.0.4078.105_150.0.4078.99.exe", hr=0x0
2026-07-31T02:12:41.846 Engine:Setting original file name "kernel32" for "c:\windows\system32\en-us\kernel32.dll.mui", hr=0x0
2026-07-31T02:12:41.908 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0
2026-07-31T02:12:42.596 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\wow64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_5e7a191fce5f84c6\rasmigplugin.dll", hr=0x0
2026-07-31T02:12:43.018 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\syswow64\windows.perception.stub.dll", hr=0x0
2026-07-31T02:12:43.752 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.251.5\psmachine_64.dll", hr=0x0
2026-07-31T02:12:44.674 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0
2026-07-31T02:12:45.174 Engine:Setting original file name "VsVersion.dll" for "c:\windows\syswow64\msvcr100_clr0400.dll", hr=0x0
2026-07-31T02:12:45.674 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\747e1cba31508bb6bd65bf9a07892fb2\mscorlib.ni.dll", hr=0x0
2026-07-31T02:12:46.065 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0
2026-07-31T02:12:46.893 Engine:Setting original file name "WinSetupUI.exe" for "c:\windows\system32\winsetupui.dll", hr=0x0
2026-07-31T02:12:47.471 Engine:Setting original file name "NOTEPAD.EXE" for "c:\windows\systemresources\notepad.exe.mun", hr=0x0
2026-07-31T02:12:50.205 Engine:Setting original file name "PlayReady Process EXE" for "c:\windows\system32\prproc.exe", hr=0x0
2026-07-31T02:12:51.049 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mpg4decd.dll", hr=0x0
2026-07-31T02:12:51.065 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0
2026-07-31T02:12:51.643 Engine:Setting original file name "WindowsCodecs" for "c:\windows\system32\windowscodecs.dll", hr=0x0
2026-07-31T02:12:51.862 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\syswow64\servicingcommon.dll", hr=0x0
2026-07-31T02:12:52.018 Engine:Setting original file name "bfsvc.exe" for "c:\windows\system32\ucsvc.exe", hr=0x0
2026-07-31T02:12:52.080 Engine:Setting original file name "audioadg.exe" for "c:\windows\system32\audiodg.exe", hr=0x0
2026-07-31T02:12:52.268 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\system32\mp4sdecd.dll", hr=0x0
2026-07-31T02:12:53.377 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0
2026-07-31T02:12:53.612 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0
2026-07-31T02:12:54.065 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnathlp.dll", hr=0x0
2026-07-31T02:12:56.330 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\syswow64\windowscodecsraw.dll", hr=0x0
2026-07-31T02:12:56.424 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0
2026-07-31T02:12:58.174 Engine:Setting original file name "security.dll" for "c:\windows\syswow64\sspicli.dll", hr=0x0
2026-07-31T02:12:58.658 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\system32\appventsubsystems64.dll", hr=0x0
2026-07-31T02:12:59.752 Engine:Setting original file name "wcp.dll" for "c:\windows\syswow64\ssshim.dll", hr=0x0
2026-07-31T02:13:00.268 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0
2026-07-31T02:13:00.393 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0
2026-07-31T02:13:01.393 Engine:Setting original file name "VsVersion.dll" for "c:\windows\system32\msvcr100_clr0400.dll", hr=0x0
2026-07-31T02:13:01.612 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mp43decd.dll", hr=0x0
2026-07-31T02:13:01.627 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0
2026-07-31T02:13:02.877 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0
2026-07-31T02:13:03.205 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0
2026-07-31T02:13:03.783 Engine:Setting original file name "gdi32" for "c:\windows\system32\gdi32.dll", hr=0x0
2026-07-31T02:13:03.830 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnhupnp.dll", hr=0x0
2026-07-31T02:13:04.283 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnaddr.dll", hr=0x0
2026-07-31T02:13:04.362 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0
2026-07-31T02:13:06.737 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0
2026-07-31T02:13:06.830 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0
2026-07-31T02:13:06.971 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0
2026-07-31T02:13:07.190 Engine:Setting original file name "extractr.exe" for "c:\windows\system32\wimserv.exe", hr=0x0
2026-07-31T02:13:08.080 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnhpast.dll", hr=0x0
2026-07-31T02:13:08.127 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\system32\migisol.dll", hr=0x0
2026-07-31T02:13:08.362 Engine:Setting original file name "WindowsCodecs" for "c:\windows\syswow64\windowscodecs.dll", hr=0x0
2026-07-31T02:13:09.283 Engine:Setting original file name "powershell.exe" for "c:\windows\system32\windowspowershell\v1.0\powershell.exe", hr=0x0
2026-07-31T02:13:09.533 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\syswow64\ddores.dll", hr=0x0
2026-07-31T02:13:09.815 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0
2026-07-31T02:13:10.268 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnet.dll", hr=0x0
2026-07-31T02:13:10.408 Engine:Setting original file name "filterLib.dll" for "c:\windows\syswow64\fltlib.dll", hr=0x0
2026-07-31T02:13:10.768 Engine:Setting original file name "Microsoft(r) DirectX for Windows(r) - Out Of Band" for "c:\program files (x86)\microsoft\edge\application\150.0.4078.105\dxil.dll", hr=0x0
2026-07-31T02:13:12.846 Engine:Setting original file name "dxmasf.dll" for "c:\windows\system32\msdxm.ocx", hr=0x0
2026-07-31T02:13:13.393 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0
2026-07-31T02:13:13.487 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0
2026-07-31T02:13:13.658 Engine:Setting original file name "rundll32.exe" for "c:\windows\syswow64\rundll32.exe", hr=0x0
2026-07-31T02:13:14.955 Engine:Setting original file name "SndVolSSO.dll" for "c:\windows\systemresources\sndvolsso.dll.mun", hr=0x0
2026-07-31T02:13:15.580 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0
2026-07-31T02:13:15.721 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0
2026-07-31T02:13:15.799 Engine:Setting original file name "mavinject64.exe" for "c:\windows\system32\mavinject.exe", hr=0x0
2026-07-31T02:13:15.830 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0
2026-07-31T02:13:16.737 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0
2026-07-31T02:13:17.440 Engine:Setting original file name "aclui.dll" for "c:\windows\winsxs\amd64_microsoft-windows-aclui_31bf3856ad364e35_10.0.20348.3451_none_fd7930e5e5e2f1f1\aclui.dll.mun", hr=0x0
2026-07-31T02:13:17.815 Engine:Setting original file name "dnsapi" for "c:\windows\system32\dnsapi.dll", hr=0x0
2026-07-31T02:13:17.940 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dplaysvr.exe", hr=0x0
2026-07-31T02:13:17.987 Engine:Setting original file name "winsqlite3" for "c:\windows\syswow64\winsqlite3.dll", hr=0x0
2026-07-31T02:13:18.596 Engine:Setting original file name "SHELL32.DLL" for "c:\windows\systemresources\shell32.dll.mun", hr=0x0
2026-07-31T02:13:18.877 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnaddr.dll", hr=0x0
2026-07-31T02:13:19.924 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnet.dll", hr=0x0
2026-07-31T02:13:20.174 Engine:Setting original file name "mapi32.dll" for "c:\windows\system32\mapistub.dll", hr=0x0
2026-07-31T02:13:21.549 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\syswow64\mtf.dll", hr=0x0
2026-07-31T02:13:21.674 Engine:Setting original file name "ACTIONCENTERCPL.DLL" for "c:\windows\systemresources\actioncentercpl.dll.mun", hr=0x0
2026-07-31T02:13:22.143 Engine:Setting original file name "UNPShared.dll" for "c:\windows\system32\upshared.dll", hr=0x0
2026-07-31T02:13:22.221 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnhpast.dll", hr=0x0
2026-07-31T02:13:22.705 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0
2026-07-31T02:13:23.065 Engine:Setting original file name " " for "c:\program files (x86)\microsoft\edge\application\150.0.4078.105\dxcompiler.dll", hr=0x0
2026-07-31T02:13:23.690 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\syswow64\migisol.dll", hr=0x0
2026-07-31T02:13:24.565 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasapi_31bf3856ad364e35_10.0.20348.4767_none_15865bee81d96dc8\pbkmigr.dll", hr=0x0
2026-07-31T02:13:24.783 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\system32\windows.perception.stub.dll", hr=0x0
2026-07-31T02:13:25.658 Engine:Setting original file name "mmcndmgr.dll" for "c:\windows\systemresources\mmcndmgr.dll.mun", hr=0x0
2026-07-31T02:13:25.846 Engine:Setting original file name "mapistub.dll" for "c:\windows\syswow64\mapi32.dll", hr=0x0
2026-07-31T02:13:27.330 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0
2026-07-31T02:13:27.408 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0
2026-07-31T02:13:28.268 Engine:Setting original file name "CRYPTUI.DLL" for "c:\windows\systemresources\cryptui.dll.mun", hr=0x0
2026-07-31T02:13:29.362 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\syswow64\textinputframework.dll", hr=0x0
2026-07-31T02:13:30.221 Engine:Setting original file name "mmcbase.dll" for "c:\windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.20348.4163_none_b803623ca7c56bdc\mmcbase.dll.mun", hr=0x0
2026-07-31T02:13:30.393 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0
2026-07-31T02:13:30.549 Engine:Setting original file name "mavinject32.exe" for "c:\windows\syswow64\mavinject.exe", hr=0x0
2026-07-31T02:13:30.596 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0
2026-07-31T02:13:30.752 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0
2026-07-31T02:13:34.127 Engine:Setting original file name "libssl" for "c:\program files\certbot\python\libssl-1_1.dll", hr=0x0
2026-07-31T02:13:34.830 Engine:Setting original file name "spwizres.dll" for "c:\windows\system32\spwizimg.dll", hr=0x0
2026-07-31T02:13:38.049 Engine:Setting original file name "Apphelp" for "c:\windows\syswow64\apphelp.dll", hr=0x0
2026-07-31T02:13:38.596 Engine:Setting original file name "MSPAINT.EXE" for "c:\windows\systemresources\mspaint.exe.mun", hr=0x0
2026-07-31T02:13:38.783 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0
2026-07-31T02:13:40.096 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\system32\mp43decd.dll", hr=0x0
2026-07-31T02:13:41.158 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0
2026-07-31T02:13:42.330 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpwsockx.dll", hr=0x0
2026-07-31T02:13:42.393 Engine:Setting original file name "Windows.Security.Credentials.UI.CredentialPicker.exe" for "c:\windows\syswow64\windows.security.credentials.ui.credentialpicker.dll", hr=0x0
2026-07-31T02:13:43.393 Engine:Setting original file name "user32" for "c:\windows\system32\user32.dll", hr=0x0
2026-07-31T02:13:43.987 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.foundation.winmd", hr=0x0
2026-07-31T02:13:44.190 Engine:Setting original file name "Apphelp" for "c:\windows\system32\apphelp.dll", hr=0x0
2026-07-31T02:13:45.518 Engine:Setting original file name "osloader.exe" for "c:\windows\system32\winload.exe", hr=0x0
2026-07-31T02:13:46.065 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0
2026-07-31T02:13:47.502 Engine:Setting original file name "mpengine.dll" for "c:\programdata\microsoft\windows defender\definition updates\stableengineetwlocation\mpengine_etw.dll", hr=0x0
2026-07-31T02:13:48.721 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0
2026-07-31T02:13:49.268 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\syswow64\appventsubsystems32.dll", hr=0x0
2026-07-31T02:13:49.533 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0
2026-07-31T02:13:50.127 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\syswow64\setup\pbkmigr.dll", hr=0x0
2026-07-31T02:13:50.143 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnathlp.dll", hr=0x0
2026-07-31T02:13:50.158 Engine:Setting original file name "Windows.Security.Credentials.UI.CredentialPicker.exe" for "c:\windows\system32\windows.security.credentials.ui.credentialpicker.dll", hr=0x0
2026-07-31T02:13:50.533 Engine:Setting original file name "libcrypto" for "c:\program files\certbot\python\libcrypto-1_1.dll", hr=0x0
2026-07-31T02:13:51.955 Engine:Setting original file name "reg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.20348.1_none_bb033180f3b60f5e\reg.exe", hr=0x0
2026-07-31T02:13:53.487 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0
2026-07-31T02:13:55.580 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\system32\ucrtbase_enclave.dll", hr=0x0
2026-07-31T02:13:57.627 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dplayx.dll", hr=0x0
2026-07-31T02:13:57.862 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32full.dll", hr=0x0
2026-07-31T02:13:59.346 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0
2026-07-31T02:13:59.440 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0
2026-07-31T02:14:00.158 Engine:Setting original file name "mf.dll" for "c:\windows\syswow64\mfpmp.exe", hr=0x0
2026-07-31T02:14:02.377 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0
2026-07-31T02:14:02.455 Engine:Setting original file name "Vulkan Runtime" for "c:\program files (x86)\microsoft\edge\application\150.0.4078.105\vulkan-1.dll", hr=0x0
2026-07-31T02:14:03.658 Engine:Setting original file name "schtasks.exe" for "c:\windows\system32\schtasks.exe", hr=0x0
2026-07-31T02:14:04.408 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0
2026-07-31T02:14:05.221 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0
2026-07-31T02:14:05.221 Engine:Setting original file name "msfltr32.acm" for "c:\windows\syswow64\msacm32.dll", hr=0x0
2026-07-31T02:14:05.674 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0
2026-07-31T02:14:05.705 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0
2026-07-31T02:14:05.955 Engine:Setting original file name "dual_engine_adapter.dll" for "c:\program files (x86)\microsoft\edge\application\150.0.4078.105\dual_engine_adapter_x64.dll", hr=0x0
2026-07-31T02:14:05.971 Engine:Setting original file name "MrmCore.dll" for "c:\windows\syswow64\mrmcorer.dll", hr=0x0
2026-07-31T02:14:07.252 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\system32\applytrustoffline.exe", hr=0x0
2026-07-31T02:14:08.221 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnhupnp.dll", hr=0x0
2026-07-31T02:14:08.330 Engine:Setting original file name "vssadmin.exe" for "c:\windows\system32\vssadmin.exe", hr=0x0
2026-07-31T02:14:08.455 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0
2026-07-31T02:14:09.190 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0
2026-07-31T02:14:09.768 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\system32\bcp47langs.dll", hr=0x0
2026-07-31T02:14:10.112 Engine:Setting original file name "stobject.dll" for "c:\windows\systemresources\stobject.dll.mun", hr=0x0
2026-07-31T02:14:10.143 Engine:Setting original file name "schtasks.exe" for "c:\windows\syswow64\schtasks.exe", hr=0x0
2026-07-31T02:14:11.987 OriginalFileName Maintenance::9106 files in Moac, 0 skipped (cached), 170 filename set
2026-07-31T02:14:11.987 [AutoPurge] Routine task for Cache Maintenance has ended.
2026-07-31T02:20:57.455 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T02:21:25.221 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T02:21:25.221 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T02:21:25.221 [Cloud] Queued cloud request.
2026-07-31T02:21:25.221 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T02:21:25.221 [Cloud] Dequeued cloud request.
2026-07-31T02:21:25.237 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T02:21:25.408 [Cloud] End of cloud request.
2026-07-31T02:21:25.924 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T02:23:22.768 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 16794, Count: 697, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-07-31T02:23:22.768 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 9573, Count: 424, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-07-31T02:23:22.768 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 8675, Count: 435, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0%
2026-07-31T02:23:22.768 ProcessImageName: powershell.exe, Pid: 6416, TotalTime: 1958, Count: 106, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 42%
2026-07-31T02:23:22.768 ProcessImageName: AgentShellService.exe, Pid: 4956, TotalTime: 1037, Count: 31, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54%
2026-07-31T02:23:22.768 ProcessImageName: WmiPrvSE.exe, Pid: 7708, TotalTime: 861, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6%
2026-07-31T02:23:22.768 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 626, Count: 30, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-07-31T02:23:22.768 ProcessImageName: WmiPrvSE.exe, Pid: 5424, TotalTime: 356, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 0%
2026-07-31T02:23:22.768 ProcessImageName: python.exe, Pid: 8460, TotalTime: 272, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\renewal.py, EstimatedImpact: 10%
2026-07-31T02:23:22.768 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 229, Count: 11, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-31T02:23:22.768 ProcessImageName: ngentask.exe, Pid: 2428, TotalTime: 213, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 42%
2026-07-31T02:23:22.768 ProcessImageName: ngentask.exe, Pid: 7916, TotalTime: 166, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 37%
2026-07-31T02:23:22.768 ProcessImageName: ngentask.exe, Pid: 8056, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 43%
2026-07-31T02:23:22.768 ProcessImageName: ngentask.exe, Pid: 1972, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 34%
2026-07-31T02:23:22.768 ProcessImageName: taskhostw.exe, Pid: 6120, TotalTime: 93, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 15%
2026-07-31T02:23:22.768 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-07-31T02:23:22.768 ProcessImageName: DeviceCensus.exe, Pid: 956, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 8%
2026-07-31T02:23:22.768 ProcessImageName: cmd.exe, Pid: 8016, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0%
2026-07-31T02:23:22.768 ProcessImageName: powershell.exe, Pid: 3664, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp32E4.tmp, EstimatedImpact: 0%
2026-07-31T02:23:22.768 ProcessImageName: mysqldump.exe, Pid: 8228, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 18%
2026-07-31T02:23:22.768 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 60, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-237f-0.MAI, EstimatedImpact: 0%
2026-07-31T02:23:22.768 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-07-31T02:23:22.768 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-07-31T02:36:02.455 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T02:42:36.814 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T02:42:36.814 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T02:42:36.814 [Cloud] Queued cloud request.
2026-07-31T02:42:36.814 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T02:42:36.814 [Cloud] Dequeued cloud request.
2026-07-31T02:42:36.814 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T02:42:36.970 [Cloud] End of cloud request.
2026-07-31T02:42:37.470 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T02:44:40.345 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T02:44:40.345 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T02:44:40.345 [Cloud] Queued cloud request.
2026-07-31T02:44:40.345 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T02:44:40.345 [Cloud] Dequeued cloud request.
2026-07-31T02:44:40.345 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T02:44:40.486 [Cloud] End of cloud request.
2026-07-31T02:44:41.002 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T02:46:08.877 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T02:46:08.877 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T02:46:08.877 [Cloud] Queued cloud request.
2026-07-31T02:46:08.877 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T02:46:08.877 [Cloud] Dequeued cloud request.
2026-07-31T02:46:08.877 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T02:46:09.111 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{71DADA91-17E5-82B5-0ADE-1FEEE90A6DED}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 02:46:09
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T02:46:09.611 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T02:48:17.236 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T02:48:17.236 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T02:48:17.236 [Cloud] Queued cloud request.
2026-07-31T02:48:17.236 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T02:48:17.236 [Cloud] Dequeued cloud request.
2026-07-31T02:48:17.392 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T02:48:17.533 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{EA179363-D739-5089-5516-D9C9AB8CB31D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 02:48:17
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T02:48:18.048 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T02:51:07.455 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T03:04:50.486 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T03:04:50.486 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T03:04:50.486 [Cloud] Queued cloud request.
2026-07-31T03:04:50.486 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T03:04:50.486 [Cloud] Dequeued cloud request.
2026-07-31T03:04:50.486 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T03:04:50.642 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{5F8E6E6A-840F-7B4F-8169-EE9A98540D75}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 03:04:50
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T03:04:51.142 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T03:06:12.454 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T03:13:58.876 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T03:13:58.876 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T03:13:58.876 [Cloud] Queued cloud request.
2026-07-31T03:13:58.876 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T03:13:58.876 [Cloud] Dequeued cloud request.
2026-07-31T03:13:58.876 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T03:13:59.048 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{CAF67006-7A9A-D935-210D-E2638056F0FD}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 03:13:59
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T03:13:59.548 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T03:18:37.360 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T03:18:37.360 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T03:18:37.360 [Cloud] Queued cloud request.
2026-07-31T03:18:37.360 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T03:18:37.360 [Cloud] Dequeued cloud request.
2026-07-31T03:18:37.376 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T03:18:37.595 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{AF5B00E5-0A5C-7946-E1A5-A0CE3BB11487}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 03:18:37
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T03:18:38.095 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T03:21:04.110 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T03:21:04.110 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T03:21:04.110 [Cloud] Queued cloud request.
2026-07-31T03:21:04.110 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T03:21:04.110 [Cloud] Dequeued cloud request.
2026-07-31T03:21:04.110 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T03:21:04.282 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E7234BF2-07BE-D0B6-346F-8577EB872504}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 03:21:04
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T03:21:04.798 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T03:21:17.454 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T03:30:49.251 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T03:30:49.251 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T03:30:49.251 [Cloud] Queued cloud request.
2026-07-31T03:30:49.251 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T03:30:49.251 [Cloud] Dequeued cloud request.
2026-07-31T03:30:49.251 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T03:30:49.423 [Cloud] End of cloud request.
2026-07-31T03:30:49.923 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T03:36:22.454 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T03:37:46.391 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T03:37:46.391 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T03:37:46.391 [Cloud] Queued cloud request.
2026-07-31T03:37:46.391 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T03:37:46.391 [Cloud] Dequeued cloud request.
2026-07-31T03:37:46.391 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T03:37:46.547 [Cloud] End of cloud request.
2026-07-31T03:37:47.047 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T03:41:35.672 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T03:41:35.672 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T03:41:35.672 [Cloud] Queued cloud request.
2026-07-31T03:41:35.672 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T03:41:35.672 [Cloud] Dequeued cloud request.
2026-07-31T03:41:35.672 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T03:41:45.766 [Cloud] End of cloud request.
2026-07-31T03:41:46.282 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T03:48:50.735 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T03:48:50.735 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T03:48:50.735 [Cloud] Queued cloud request.
2026-07-31T03:48:50.735 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T03:48:50.735 [Cloud] Dequeued cloud request.
2026-07-31T03:48:50.735 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T03:48:50.891 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{86F7BD5C-C4D9-4193-35FC-88CDA12448E9}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 03:48:50
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T03:48:51.391 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T03:51:27.453 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T04:00:49.391 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T04:00:49.391 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T04:00:49.391 [Cloud] Queued cloud request.
2026-07-31T04:00:49.391 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T04:00:49.391 [Cloud] Dequeued cloud request.
2026-07-31T04:00:49.391 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T04:00:49.531 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{C6937CF3-EA90-F2E2-B0D4-1ECEA7E1BFBF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 04:00:49
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T04:00:50.031 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T04:03:59.453 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T04:03:59.453 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T04:03:59.453 [Cloud] Queued cloud request.
2026-07-31T04:03:59.453 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T04:03:59.453 [Cloud] Dequeued cloud request.
2026-07-31T04:03:59.453 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T04:03:59.609 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{BABA29EF-F15B-6BFC-511F-F3DE34B033BF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 04:03:59
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T04:04:00.109 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T04:06:32.453 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T04:08:56.531 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T04:08:56.531 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T04:08:56.531 [Cloud] Queued cloud request.
2026-07-31T04:08:56.531 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T04:08:56.531 [Cloud] Dequeued cloud request.
2026-07-31T04:08:56.547 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T04:08:56.687 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{98288483-DFC4-8621-D286-D14A3759D29B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 04:08:56
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T04:08:57.187 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T04:21:37.453 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T04:23:22.765 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 16794, Count: 697, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-07-31T04:23:22.765 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 13570, Count: 613, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-07-31T04:23:22.765 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 9415, Count: 467, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\inc\header.inc.php, EstimatedImpact: 0%
2026-07-31T04:23:22.765 ProcessImageName: powershell.exe, Pid: 6416, TotalTime: 1958, Count: 106, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 42%
2026-07-31T04:23:22.765 ProcessImageName: php.exe, Pid: 7044, TotalTime: 1361, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 38%
2026-07-31T04:23:22.765 ProcessImageName: AgentShellService.exe, Pid: 4956, TotalTime: 1037, Count: 31, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54%
2026-07-31T04:23:22.765 ProcessImageName: WmiPrvSE.exe, Pid: 7708, TotalTime: 861, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6%
2026-07-31T04:23:22.765 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 780, Count: 36, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-07-31T04:23:22.765 ProcessImageName: WmiPrvSE.exe, Pid: 776, TotalTime: 533, Count: 39, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 40%
2026-07-31T04:23:22.765 ProcessImageName: WmiPrvSE.exe, Pid: 5424, TotalTime: 356, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 0%
2026-07-31T04:23:22.765 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 275, Count: 13, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-31T04:23:22.765 ProcessImageName: python.exe, Pid: 8460, TotalTime: 272, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\renewal.py, EstimatedImpact: 10%
2026-07-31T04:23:22.765 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 232, Count: 4, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-07-31T04:23:22.765 ProcessImageName: ngentask.exe, Pid: 2428, TotalTime: 213, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 42%
2026-07-31T04:23:22.765 ProcessImageName: ngentask.exe, Pid: 7916, TotalTime: 166, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 37%
2026-07-31T04:23:22.765 ProcessImageName: cmd.exe, Pid: 7708, TotalTime: 155, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 100%
2026-07-31T04:23:22.765 ProcessImageName: ngentask.exe, Pid: 8056, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 43%
2026-07-31T04:23:22.765 ProcessImageName: ngentask.exe, Pid: 1972, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 34%
2026-07-31T04:23:22.765 ProcessImageName: taskhostw.exe, Pid: 6120, TotalTime: 93, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 15%
2026-07-31T04:23:22.765 ProcessImageName: DeviceCensus.exe, Pid: 956, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 8%
2026-07-31T04:23:22.765 ProcessImageName: cmd.exe, Pid: 8016, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0%
2026-07-31T04:23:22.765 ProcessImageName: powershell.exe, Pid: 3664, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp32E4.tmp, EstimatedImpact: 0%
2026-07-31T04:23:22.765 ProcessImageName: mysqldump.exe, Pid: 8228, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 18%
2026-07-31T04:23:22.765 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 60, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-237f-0.MAI, EstimatedImpact: 0%
2026-07-31T04:23:22.765 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-07-31T04:23:22.765 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-07-31T04:35:19.156 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T04:35:19.156 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T04:35:19.156 [Cloud] Queued cloud request.
2026-07-31T04:35:19.156 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T04:35:19.156 [Cloud] Dequeued cloud request.
2026-07-31T04:35:19.171 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T04:35:19.359 [Cloud] End of cloud request.
2026-07-31T04:35:19.859 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T04:36:42.453 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T04:42:55.202 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T04:42:55.202 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T04:42:55.202 [Cloud] Queued cloud request.
2026-07-31T04:42:55.202 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T04:42:55.202 [Cloud] Dequeued cloud request.
2026-07-31T04:42:55.202 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T04:42:55.421 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{53FA074E-F7B1-85AC-4537-0DAB4957F08A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 04:42:55
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T04:42:55.937 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T04:49:49.093 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T04:49:49.093 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T04:49:49.093 [Cloud] Queued cloud request.
2026-07-31T04:49:49.093 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T04:49:49.093 [Cloud] Dequeued cloud request.
2026-07-31T04:49:49.093 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T04:49:49.296 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{BE32851E-7105-B3F4-FDBB-FEBEA484E4CA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 04:49:49
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T04:49:49.796 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T04:51:47.452 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T05:06:52.452 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T05:07:30.249 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T05:07:30.249 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T05:07:30.249 [Cloud] Queued cloud request.
2026-07-31T05:07:30.249 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T05:07:30.249 [Cloud] Dequeued cloud request.
2026-07-31T05:07:30.249 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T05:07:30.405 [Cloud] End of cloud request.
2026-07-31T05:07:30.905 [NRI] Successfully updated NIS service with platform settings for enforcement level Log

BEGIN BM telemetry
GUID:{5425E207-08ED-31C0-3DA6-2741E08C86A5}
SignatureID:55746285003867
SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df
ThreatLevel:0
ProcessID:2852
ProcessCreationTime:134285983332457305
SessionID:0
CreationTime:07-31-2026 05:09:25
ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T05:09:27.077 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T05:09:27.077 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T05:09:27.077 [Cloud] Queued cloud request.
2026-07-31T05:09:27.077 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T05:09:27.077 [Cloud] Dequeued cloud request.
2026-07-31T05:09:27.077 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T05:09:27.405 [Cloud] End of cloud request.
2026-07-31T05:09:27.905 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T05:21:57.452 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T05:27:01.920 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T05:27:01.920 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T05:27:01.920 [Cloud] Queued cloud request.
2026-07-31T05:27:01.920 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T05:27:01.920 [Cloud] Dequeued cloud request.
2026-07-31T05:27:01.920 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T05:27:02.170 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{04A852DF-0DD2-64EB-D423-77EF248DFF0F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 05:27:02
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T05:27:02.686 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T05:37:02.451 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T05:52:07.451 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T05:58:03.326 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T05:58:03.326 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T05:58:03.326 [Cloud] Queued cloud request.
2026-07-31T05:58:03.326 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T05:58:03.544 [Cloud] Dequeued cloud request.
2026-07-31T05:58:03.544 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T05:58:03.716 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{5498BB7E-33E8-C8BB-7139-0E636CF27D36}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 05:58:03
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T05:58:04.216 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T05:59:14.060 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T05:59:14.060 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T05:59:14.060 [Cloud] Queued cloud request.
2026-07-31T05:59:14.060 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T05:59:14.060 [Cloud] Dequeued cloud request.
2026-07-31T05:59:14.060 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T05:59:14.201 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4DB8FCFE-2EFC-A687-464C-61605C7E41C3}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 05:59:14
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T05:59:14.701 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T06:07:12.451 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T06:22:17.450 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T06:23:22.778 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 17526, Count: 792, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-07-31T06:23:22.778 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 16794, Count: 697, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-07-31T06:23:22.778 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 11345, Count: 616, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\inc\header.inc.php, EstimatedImpact: 0%
2026-07-31T06:23:22.778 ProcessImageName: powershell.exe, Pid: 6416, TotalTime: 1958, Count: 106, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 42%
2026-07-31T06:23:22.778 ProcessImageName: php.exe, Pid: 7044, TotalTime: 1361, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 38%
2026-07-31T06:23:22.778 ProcessImageName: AgentShellService.exe, Pid: 4956, TotalTime: 1037, Count: 31, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54%
2026-07-31T06:23:22.778 ProcessImageName: WmiPrvSE.exe, Pid: 7708, TotalTime: 861, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6%
2026-07-31T06:23:22.778 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 780, Count: 36, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-07-31T06:23:22.778 ProcessImageName: WmiPrvSE.exe, Pid: 776, TotalTime: 533, Count: 39, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 40%
2026-07-31T06:23:22.778 ProcessImageName: WmiPrvSE.exe, Pid: 5424, TotalTime: 356, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 0%
2026-07-31T06:23:22.778 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 290, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-31T06:23:22.778 ProcessImageName: python.exe, Pid: 8460, TotalTime: 272, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\renewal.py, EstimatedImpact: 10%
2026-07-31T06:23:22.778 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 232, Count: 4, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-07-31T06:23:22.778 ProcessImageName: ngentask.exe, Pid: 2428, TotalTime: 213, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 42%
2026-07-31T06:23:22.778 ProcessImageName: ngentask.exe, Pid: 7916, TotalTime: 166, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 37%
2026-07-31T06:23:22.778 ProcessImageName: cmd.exe, Pid: 7708, TotalTime: 155, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 100%
2026-07-31T06:23:22.778 ProcessImageName: ngentask.exe, Pid: 8056, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 43%
2026-07-31T06:23:22.778 ProcessImageName: ngentask.exe, Pid: 1972, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 34%
2026-07-31T06:23:22.778 ProcessImageName: taskhostw.exe, Pid: 6120, TotalTime: 93, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 15%
2026-07-31T06:23:22.778 ProcessImageName: DeviceCensus.exe, Pid: 956, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 8%
2026-07-31T06:23:22.778 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 75, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-237f-0.MAI, EstimatedImpact: 0%
2026-07-31T06:23:22.778 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 75, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-07-31T06:23:22.778 ProcessImageName: cmd.exe, Pid: 8016, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0%
2026-07-31T06:23:22.778 ProcessImageName: powershell.exe, Pid: 3664, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp32E4.tmp, EstimatedImpact: 0%
2026-07-31T06:23:22.778 ProcessImageName: mysqldump.exe, Pid: 8228, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 18%
2026-07-31T06:23:22.778 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-07-31T06:26:15.216 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T06:26:15.216 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T06:26:15.216 [Cloud] Queued cloud request.
2026-07-31T06:26:15.216 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T06:26:15.216 [Cloud] Dequeued cloud request.
2026-07-31T06:26:15.232 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T06:26:15.372 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F081DC6E-2C4E-FA32-84ED-7C87EB079D71}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 06:26:15
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T06:26:15.888 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T06:27:59.013 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T06:27:59.013 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T06:27:59.013 [Cloud] Queued cloud request.
2026-07-31T06:27:59.013 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T06:27:59.013 [Cloud] Dequeued cloud request.
2026-07-31T06:27:59.013 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T06:27:59.153 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{59318F1F-450D-2793-B5C2-E10745C9DEBB}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 06:27:59
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T06:27:59.669 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T06:37:22.450 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T06:45:40.106 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T06:45:40.106 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T06:45:40.106 [Cloud] Queued cloud request.
2026-07-31T06:45:40.106 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T06:45:40.106 [Cloud] Dequeued cloud request.
2026-07-31T06:45:40.106 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T06:45:40.325 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{D71A5FF0-1E8A-4531-DCB9-2987CF261C45}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 06:45:40
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T06:45:40.840 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T06:52:27.450 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T06:52:52.731 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T06:52:52.731 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T06:52:52.731 [Cloud] Queued cloud request.
2026-07-31T06:52:52.731 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T06:52:52.731 [Cloud] Dequeued cloud request.
2026-07-31T06:52:52.731 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T06:52:52.918 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E4E31A45-6012-7D71-D4D7-19FD6BE1E719}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 06:52:52
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T06:52:53.434 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T07:07:32.449 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T07:19:23.527 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T07:19:23.527 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T07:19:23.527 [Cloud] Queued cloud request.
2026-07-31T07:19:23.527 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T07:19:23.527 [Cloud] Dequeued cloud request.
2026-07-31T07:19:23.527 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T07:19:23.683 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F46E7031-A8B8-7EDD-25EC-9757E836DFC0}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 07:19:23
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T07:19:24.183 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T07:22:37.449 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T07:24:18.074 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T07:24:18.074 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T07:24:18.074 [Cloud] Queued cloud request.
2026-07-31T07:24:18.074 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T07:24:18.074 [Cloud] Dequeued cloud request.
2026-07-31T07:24:18.074 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T07:24:18.230 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{C2303765-43C8-6C2F-362F-4BBA1F886BEE}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 07:24:18
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T07:24:18.746 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T07:27:24.949 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T07:27:24.949 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T07:27:24.949 [Cloud] Queued cloud request.
2026-07-31T07:27:24.949 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T07:27:24.949 [Cloud] Dequeued cloud request.
2026-07-31T07:27:24.949 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T07:27:25.105 [Cloud] End of cloud request.
2026-07-31T07:27:25.605 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T07:32:15.073 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T07:32:15.073 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T07:32:15.073 [Cloud] Queued cloud request.
2026-07-31T07:32:15.073 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T07:32:15.073 [Cloud] Dequeued cloud request.
2026-07-31T07:32:15.073 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T07:32:15.277 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{20366C29-148C-65CC-8CFC-4BE054557605}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 07:32:15
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T07:32:15.792 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T07:37:42.448 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T07:41:03.151 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T07:41:03.151 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T07:41:03.151 [Cloud] Queued cloud request.
2026-07-31T07:41:03.151 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T07:41:03.151 [Cloud] Dequeued cloud request.
2026-07-31T07:41:03.151 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T07:41:03.370 [Cloud] End of cloud request.
2026-07-31T07:41:03.870 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T07:47:43.995 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T07:47:43.995 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T07:47:43.995 [Cloud] Queued cloud request.
2026-07-31T07:47:43.995 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T07:47:44.167 [Cloud] Dequeued cloud request.
2026-07-31T07:47:44.323 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T07:47:44.526 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{91E184EB-B869-4D7D-D0FB-BCDF2A7A323B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 07:47:44
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T07:47:45.042 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T07:48:18.589 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T07:48:18.589 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T07:48:18.589 [Cloud] Queued cloud request.
2026-07-31T07:48:18.589 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T07:48:18.589 [Cloud] Dequeued cloud request.
2026-07-31T07:48:18.589 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T07:48:18.714 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{40101C69-6CF6-31E7-B429-1A8C84B5DE97}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 07:48:18
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T07:48:19.229 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T07:52:47.448 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T08:07:52.447 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T08:22:57.447 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T08:23:22.775 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 21407, Count: 971, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-07-31T08:23:22.775 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 16794, Count: 697, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-07-31T08:23:22.775 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 11576, Count: 624, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\inc\header.inc.php, EstimatedImpact: 0%
2026-07-31T08:23:22.775 ProcessImageName: powershell.exe, Pid: 6416, TotalTime: 1958, Count: 106, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 42%
2026-07-31T08:23:22.775 ProcessImageName: php.exe, Pid: 7044, TotalTime: 1361, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 38%
2026-07-31T08:23:22.775 ProcessImageName: AgentShellService.exe, Pid: 4956, TotalTime: 1037, Count: 31, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54%
2026-07-31T08:23:22.775 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 948, Count: 44, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-07-31T08:23:22.775 ProcessImageName: WmiPrvSE.exe, Pid: 7708, TotalTime: 861, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6%
2026-07-31T08:23:22.775 ProcessImageName: WmiPrvSE.exe, Pid: 776, TotalTime: 533, Count: 39, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 40%
2026-07-31T08:23:22.775 ProcessImageName: WmiPrvSE.exe, Pid: 5424, TotalTime: 356, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 0%
2026-07-31T08:23:22.775 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 305, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-31T08:23:22.775 ProcessImageName: python.exe, Pid: 8460, TotalTime: 272, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\renewal.py, EstimatedImpact: 10%
2026-07-31T08:23:22.775 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 232, Count: 4, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-07-31T08:23:22.775 ProcessImageName: ngentask.exe, Pid: 2428, TotalTime: 213, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 42%
2026-07-31T08:23:22.775 ProcessImageName: ngentask.exe, Pid: 7916, TotalTime: 166, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 37%
2026-07-31T08:23:22.775 ProcessImageName: cmd.exe, Pid: 7708, TotalTime: 155, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 100%
2026-07-31T08:23:22.775 ProcessImageName: ngentask.exe, Pid: 8056, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 43%
2026-07-31T08:23:22.775 ProcessImageName: ngentask.exe, Pid: 1972, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 34%
2026-07-31T08:23:22.775 ProcessImageName: taskhostw.exe, Pid: 6120, TotalTime: 93, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 15%
2026-07-31T08:23:22.775 ProcessImageName: DeviceCensus.exe, Pid: 956, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 8%
2026-07-31T08:23:22.775 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 75, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-237f-0.MAI, EstimatedImpact: 0%
2026-07-31T08:23:22.775 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 75, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-07-31T08:23:22.775 ProcessImageName: cmd.exe, Pid: 8016, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0%
2026-07-31T08:23:22.775 ProcessImageName: powershell.exe, Pid: 3664, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp32E4.tmp, EstimatedImpact: 0%
2026-07-31T08:23:22.775 ProcessImageName: mysqldump.exe, Pid: 8228, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 18%
2026-07-31T08:23:22.775 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-07-31T08:24:24.478 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T08:24:24.478 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T08:24:24.478 [Cloud] Queued cloud request.
2026-07-31T08:24:24.478 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T08:24:24.478 [Cloud] Dequeued cloud request.
2026-07-31T08:24:24.478 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T08:24:24.650 [Cloud] End of cloud request.
2026-07-31T08:24:25.150 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T08:26:42.447 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T08:26:42.447 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T08:26:42.447 [Cloud] Queued cloud request.
2026-07-31T08:26:42.447 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T08:26:42.447 [Cloud] Dequeued cloud request.
2026-07-31T08:26:42.447 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T08:26:42.681 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{AD3725D5-1676-DCDF-D9FB-3A5870B21800}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 08:26:42
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T08:26:43.197 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T08:27:27.541 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T08:27:27.541 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T08:27:27.541 [Cloud] Queued cloud request.
2026-07-31T08:27:27.541 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T08:27:27.556 [Cloud] Dequeued cloud request.
2026-07-31T08:27:27.556 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T08:27:27.634 [Cloud] End of cloud request.
2026-07-31T08:27:28.134 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T08:30:14.916 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T08:30:14.916 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T08:30:14.916 [Cloud] Queued cloud request.
2026-07-31T08:30:14.916 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T08:30:14.916 [Cloud] Dequeued cloud request.
2026-07-31T08:30:14.916 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T08:30:15.072 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4AD3BF45-A084-84E3-31F4-014C7489EF4F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 08:30:15
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T08:30:15.572 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T08:30:27.072 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T08:30:27.072 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T08:30:27.072 [Cloud] Queued cloud request.
2026-07-31T08:30:27.072 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T08:30:27.072 [Cloud] Dequeued cloud request.
2026-07-31T08:30:27.072 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T08:30:27.166 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{16B17515-0186-BA23-91B6-CACAACFA4B00}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 08:30:27
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T08:30:27.666 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T08:38:02.447 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T08:53:07.446 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T08:55:47.868 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T08:55:47.868 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T08:55:47.868 [Cloud] Queued cloud request.
2026-07-31T08:55:47.868 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T08:55:47.868 [Cloud] Dequeued cloud request.
2026-07-31T08:55:47.884 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T08:55:48.071 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{03286867-16A2-D27F-F403-3E26121BA910}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 08:55:48
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T08:55:48.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T08:57:27.103 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T08:57:27.103 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T08:57:27.103 [Cloud] Queued cloud request.
2026-07-31T08:57:27.103 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T08:57:27.103 [Cloud] Dequeued cloud request.
2026-07-31T08:57:27.103 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T08:57:27.290 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9184FFFF-D96B-FBEC-54DB-3C822BCAD5A0}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 08:57:27
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T08:57:27.806 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T09:08:12.446 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T09:13:55.712 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T09:13:55.712 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T09:13:55.712 [Cloud] Queued cloud request.
2026-07-31T09:13:55.712 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T09:13:55.712 [Cloud] Dequeued cloud request.
2026-07-31T09:13:55.727 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T09:13:55.946 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{734C77E0-5256-67CF-74B7-D23D6E790DEB}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 09:13:55
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T09:13:56.446 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T09:18:13.711 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T09:18:13.711 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T09:18:13.711 [Cloud] Queued cloud request.
2026-07-31T09:18:13.711 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T09:18:13.711 [Cloud] Dequeued cloud request.
2026-07-31T09:18:13.711 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T09:18:13.883 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{263A7AE1-B768-E6DF-946D-2F5DE5358FC0}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 09:18:13
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T09:18:14.383 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T09:21:45.961 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T09:21:45.961 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T09:21:45.961 [Cloud] Queued cloud request.
2026-07-31T09:21:45.961 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T09:21:45.961 [Cloud] Dequeued cloud request.
2026-07-31T09:21:45.961 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T09:21:46.165 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{00027E0C-5555-629E-BDD0-8D5AF3F82861}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 09:21:46
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T09:21:46.680 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T09:23:17.446 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T09:33:27.492 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T09:33:27.492 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T09:33:27.492 [Cloud] Queued cloud request.
2026-07-31T09:33:27.492 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T09:33:27.492 [Cloud] Dequeued cloud request.
2026-07-31T09:33:27.492 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T09:33:27.649 [Cloud] End of cloud request.
2026-07-31T09:33:28.149 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T09:38:22.445 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T09:40:25.242 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T09:40:25.242 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T09:40:25.242 [Cloud] Queued cloud request.
2026-07-31T09:40:25.242 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T09:40:25.242 [Cloud] Dequeued cloud request.
2026-07-31T09:40:25.242 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T09:40:25.399 [Cloud] End of cloud request.
2026-07-31T09:40:25.899 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T09:44:19.211 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T09:44:19.211 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T09:44:19.211 [Cloud] Queued cloud request.
2026-07-31T09:44:19.211 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T09:44:19.211 [Cloud] Dequeued cloud request.
2026-07-31T09:44:19.211 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T09:44:19.383 [Cloud] End of cloud request.
2026-07-31T09:44:19.883 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T09:47:20.430 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T09:47:20.430 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T09:47:20.430 [Cloud] Queued cloud request.
2026-07-31T09:47:20.430 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T09:47:20.445 [Cloud] Dequeued cloud request.
2026-07-31T09:47:20.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T09:47:20.695 [Cloud] End of cloud request.
2026-07-31T09:47:21.195 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T09:53:27.445 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T09:57:34.633 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T09:57:34.633 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T09:57:34.633 [Cloud] Queued cloud request.
2026-07-31T09:57:34.633 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T09:57:34.836 [Cloud] Dequeued cloud request.
2026-07-31T09:57:34.836 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T09:57:35.008 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{DE808EDC-A9C5-E3D3-A822-1085A253E4E5}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 09:57:35
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T09:57:35.523 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T09:58:21.555 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T09:58:21.555 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T09:58:21.555 [Cloud] Queued cloud request.
2026-07-31T09:58:21.555 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T09:58:21.555 [Cloud] Dequeued cloud request.
2026-07-31T09:58:21.555 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T09:58:21.648 [Cloud] End of cloud request.
2026-07-31T09:58:22.148 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T10:02:21.336 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T10:02:21.336 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T10:02:21.351 [Cloud] Queued cloud request.
2026-07-31T10:02:21.351 [Cloud] Dequeued cloud request.
2026-07-31T10:02:21.351 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T10:02:21.351 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T10:02:21.508 [Cloud] End of cloud request.
2026-07-31T10:02:22.023 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T10:08:32.445 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T10:23:22.789 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 25739, Count: 1144, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-07-31T10:23:22.789 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 16794, Count: 697, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-07-31T10:23:22.789 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 11714, Count: 631, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\inc\header.inc.php, EstimatedImpact: 0%
2026-07-31T10:23:22.789 ProcessImageName: powershell.exe, Pid: 6416, TotalTime: 1958, Count: 106, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 42%
2026-07-31T10:23:22.789 ProcessImageName: php.exe, Pid: 7044, TotalTime: 1361, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 38%
2026-07-31T10:23:22.789 ProcessImageName: AgentShellService.exe, Pid: 4956, TotalTime: 1037, Count: 31, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54%
2026-07-31T10:23:22.789 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 948, Count: 45, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-07-31T10:23:22.789 ProcessImageName: WmiPrvSE.exe, Pid: 7708, TotalTime: 861, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6%
2026-07-31T10:23:22.789 ProcessImageName: WmiPrvSE.exe, Pid: 776, TotalTime: 533, Count: 39, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 40%
2026-07-31T10:23:22.789 ProcessImageName: WmiPrvSE.exe, Pid: 5424, TotalTime: 356, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 0%
2026-07-31T10:23:22.789 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 320, Count: 16, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-31T10:23:22.789 ProcessImageName: python.exe, Pid: 8460, TotalTime: 272, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\renewal.py, EstimatedImpact: 10%
2026-07-31T10:23:22.789 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 232, Count: 4, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-07-31T10:23:22.789 ProcessImageName: ngentask.exe, Pid: 2428, TotalTime: 213, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 42%
2026-07-31T10:23:22.789 ProcessImageName: ngentask.exe, Pid: 7916, TotalTime: 166, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 37%
2026-07-31T10:23:22.789 ProcessImageName: cmd.exe, Pid: 7708, TotalTime: 155, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 100%
2026-07-31T10:23:22.789 ProcessImageName: ngentask.exe, Pid: 8056, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 43%
2026-07-31T10:23:22.789 ProcessImageName: ngentask.exe, Pid: 1972, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 34%
2026-07-31T10:23:22.789 ProcessImageName: taskhostw.exe, Pid: 6120, TotalTime: 93, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 15%
2026-07-31T10:23:22.789 ProcessImageName: DeviceCensus.exe, Pid: 956, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 8%
2026-07-31T10:23:22.789 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 75, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-237f-0.MAI, EstimatedImpact: 0%
2026-07-31T10:23:22.789 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 75, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-07-31T10:23:22.789 ProcessImageName: cmd.exe, Pid: 8016, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0%
2026-07-31T10:23:22.789 ProcessImageName: powershell.exe, Pid: 3664, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp32E4.tmp, EstimatedImpact: 0%
2026-07-31T10:23:22.789 ProcessImageName: mysqldump.exe, Pid: 8228, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 18%
2026-07-31T10:23:22.789 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-07-31T10:23:37.445 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T10:25:02.179 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T10:25:02.179 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T10:25:02.179 [Cloud] Queued cloud request.
2026-07-31T10:25:02.179 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T10:25:02.179 [Cloud] Dequeued cloud request.
2026-07-31T10:25:02.179 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T10:25:02.351 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E72C47FB-ABC2-632D-A464-67260640D137}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 10:25:02
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T10:25:02.851 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T10:28:23.820 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T10:28:23.820 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T10:28:23.820 [Cloud] Queued cloud request.
2026-07-31T10:28:23.820 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T10:28:23.820 [Cloud] Dequeued cloud request.
2026-07-31T10:28:23.820 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T10:28:23.976 [Cloud] End of cloud request.
2026-07-31T10:28:24.492 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T10:34:00.351 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T10:34:00.351 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T10:34:00.351 [Cloud] Queued cloud request.
2026-07-31T10:34:00.351 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T10:34:00.351 [Cloud] Dequeued cloud request.
2026-07-31T10:34:00.351 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T10:34:00.523 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{8E227363-6181-B296-6C1B-FCDBEACE8329}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 10:34:00
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T10:34:01.023 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T10:34:40.038 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T10:34:40.038 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T10:34:40.038 [Cloud] Queued cloud request.
2026-07-31T10:34:40.038 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T10:34:40.038 [Cloud] Dequeued cloud request.
2026-07-31T10:34:40.038 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T10:34:40.132 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{085DE39C-29D6-AE8A-F36D-4C8546BE4CA0}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 10:34:40
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T10:34:40.632 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T10:38:19.632 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T10:38:19.632 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T10:38:19.632 [Cloud] Queued cloud request.
2026-07-31T10:38:19.632 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T10:38:19.632 [Cloud] Dequeued cloud request.
2026-07-31T10:38:19.632 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T10:38:19.820 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{94A3E8F5-D4FD-46EA-3B54-AAC4501D994C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 10:38:19
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T10:38:20.320 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T10:38:42.445 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T10:41:54.491 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T10:41:54.491 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T10:41:54.491 [Cloud] Queued cloud request.
2026-07-31T10:41:54.491 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T10:41:54.491 [Cloud] Dequeued cloud request.
2026-07-31T10:41:54.491 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T10:41:54.679 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4077A3B1-4E67-7BEC-795C-09999780796C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 10:41:54
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T10:41:55.179 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T10:42:45.398 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T10:42:45.398 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T10:42:45.398 [Cloud] Queued cloud request.
2026-07-31T10:42:45.398 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T10:42:45.398 [Cloud] Dequeued cloud request.
2026-07-31T10:42:45.413 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T10:42:45.491 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{ECBB123E-A19C-774C-194D-9B25383A66DA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 10:42:45
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T10:42:45.991 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T10:51:29.913 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T10:51:29.913 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T10:51:29.913 [Cloud] Queued cloud request.
2026-07-31T10:51:29.913 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T10:51:29.913 [Cloud] Dequeued cloud request.
2026-07-31T10:51:29.913 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T10:51:30.054 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{5171085A-0AA6-BC39-E834-B6617D043B7F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 10:51:30
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T10:51:30.554 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T10:53:47.444 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T10:54:02.038 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T10:54:02.038 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T10:54:02.038 [Cloud] Queued cloud request.
2026-07-31T10:54:02.038 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T10:54:02.054 [Cloud] Dequeued cloud request.
2026-07-31T10:54:02.054 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T10:54:02.194 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{10DB7F6B-497B-CE3B-49E9-9957E6DF4D40}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 10:54:02
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T10:54:02.710 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T10:57:46.116 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T10:57:46.116 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T10:57:46.116 [Cloud] Queued cloud request.
2026-07-31T10:57:46.116 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T10:57:46.116 [Cloud] Dequeued cloud request.
2026-07-31T10:57:46.116 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T10:57:46.272 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9604803E-FF2D-4CB2-8186-8408574F1CFF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 10:57:46
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T10:57:46.772 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T10:58:17.132 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T10:58:17.132 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T10:58:17.132 [Cloud] Queued cloud request.
2026-07-31T10:58:17.132 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T10:58:17.132 [Cloud] Dequeued cloud request.
2026-07-31T10:58:17.132 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T10:58:17.226 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{6D9F912F-4CCC-5154-05FE-F03CC904EDAA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 10:58:17
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T10:58:17.741 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T11:02:12.851 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T11:02:12.851 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T11:02:12.851 [Cloud] Queued cloud request.
2026-07-31T11:02:12.851 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T11:02:12.851 [Cloud] Dequeued cloud request.
2026-07-31T11:02:12.851 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T11:02:13.054 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{AC534073-28E6-45CE-A7C4-07D0598FCB76}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 11:02:13
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T11:02:13.554 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T11:08:52.444 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T11:13:44.085 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T11:13:44.085 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T11:13:44.085 [Cloud] Queued cloud request.
2026-07-31T11:13:44.085 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T11:13:44.085 [Cloud] Dequeued cloud request.
2026-07-31T11:13:44.085 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T11:13:44.241 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2684F164-7D94-8D16-DDCF-528D07A79679}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 11:13:44
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T11:13:44.741 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T11:19:23.038 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T11:19:23.038 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T11:19:23.038 [Cloud] Queued cloud request.
2026-07-31T11:19:23.038 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T11:19:23.038 [Cloud] Dequeued cloud request.
2026-07-31T11:19:23.038 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T11:19:23.444 [Cloud] End of cloud request.
2026-07-31T11:19:23.944 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T11:23:57.444 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T11:24:22.413 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T11:24:22.413 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T11:24:22.413 [Cloud] Queued cloud request.
2026-07-31T11:24:22.413 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T11:24:22.413 [Cloud] Dequeued cloud request.
2026-07-31T11:24:22.413 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T11:24:22.600 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E25F6DE7-869C-B60C-E631-4698B3984D3A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 11:24:22
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T11:24:23.100 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T11:39:02.444 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T11:49:20.256 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T11:49:20.256 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T11:49:20.256 [Cloud] Queued cloud request.
2026-07-31T11:49:20.256 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T11:49:20.256 [Cloud] Dequeued cloud request.
2026-07-31T11:49:20.256 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T11:49:20.428 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{B1619FCF-0E2A-E53F-8F1B-61EDB5860C52}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 11:49:20
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T11:49:20.928 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T11:54:07.444 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T11:58:08.490 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T11:58:08.490 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T11:58:08.490 [Cloud] Queued cloud request.
2026-07-31T11:58:08.490 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T11:58:08.490 [Cloud] Dequeued cloud request.
2026-07-31T11:58:08.490 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T11:58:08.647 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{ACADCA88-F1D4-AE8D-6351-8E572B05F9D6}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 11:58:08
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T11:58:09.162 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T12:00:42.600 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T12:00:42.600 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T12:00:42.600 [Cloud] Queued cloud request.
2026-07-31T12:00:42.600 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T12:00:42.600 [Cloud] Dequeued cloud request.
2026-07-31T12:00:42.600 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T12:00:42.787 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{C1F221FF-83E6-58C0-813B-B2DECD293ED6}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 12:00:42
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T12:00:43.303 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T12:05:40.428 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T12:05:40.428 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T12:05:40.428 [Cloud] Queued cloud request.
2026-07-31T12:05:40.428 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T12:05:40.428 [Cloud] Dequeued cloud request.
2026-07-31T12:05:40.428 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T12:05:40.615 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{519533F3-AE36-7D09-A379-80BF7B0DC5FA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 12:05:40
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T12:05:41.131 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T12:09:12.443 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T12:11:31.287 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T12:11:31.287 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T12:11:31.287 [Cloud] Queued cloud request.
2026-07-31T12:11:31.287 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T12:11:31.287 [Cloud] Dequeued cloud request.
2026-07-31T12:11:31.287 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T12:11:31.459 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E31DD1F4-D4C7-4EDA-6FCC-9EB02CF53031}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 12:11:31
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T12:11:31.975 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T12:23:22.803 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 30239, Count: 1325, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-07-31T12:23:22.803 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 16794, Count: 697, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-07-31T12:23:22.803 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 12413, Count: 709, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\inc\header.inc.php, EstimatedImpact: 0%
2026-07-31T12:23:22.803 ProcessImageName: powershell.exe, Pid: 6416, TotalTime: 1958, Count: 106, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 42%
2026-07-31T12:23:22.803 ProcessImageName: php.exe, Pid: 7044, TotalTime: 1361, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 38%
2026-07-31T12:23:22.803 ProcessImageName: AgentShellService.exe, Pid: 4956, TotalTime: 1037, Count: 31, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54%
2026-07-31T12:23:22.803 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1024, Count: 49, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-07-31T12:23:22.803 ProcessImageName: WmiPrvSE.exe, Pid: 7708, TotalTime: 861, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6%
2026-07-31T12:23:22.803 ProcessImageName: WmiPrvSE.exe, Pid: 776, TotalTime: 533, Count: 39, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 40%
2026-07-31T12:23:22.803 ProcessImageName: WmiPrvSE.exe, Pid: 5424, TotalTime: 356, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 0%
2026-07-31T12:23:22.803 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 350, Count: 18, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-31T12:23:22.803 ProcessImageName: python.exe, Pid: 8460, TotalTime: 272, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\renewal.py, EstimatedImpact: 10%
2026-07-31T12:23:22.803 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 232, Count: 4, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-07-31T12:23:22.803 ProcessImageName: ngentask.exe, Pid: 2428, TotalTime: 213, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 42%
2026-07-31T12:23:22.803 ProcessImageName: ngentask.exe, Pid: 7916, TotalTime: 166, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 37%
2026-07-31T12:23:22.803 ProcessImageName: cmd.exe, Pid: 7708, TotalTime: 155, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 100%
2026-07-31T12:23:22.803 ProcessImageName: ngentask.exe, Pid: 8056, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 43%
2026-07-31T12:23:22.803 ProcessImageName: ngentask.exe, Pid: 1972, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 34%
2026-07-31T12:23:22.803 ProcessImageName: taskhostw.exe, Pid: 6120, TotalTime: 93, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 15%
2026-07-31T12:23:22.803 ProcessImageName: DeviceCensus.exe, Pid: 956, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 8%
2026-07-31T12:23:22.803 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 75, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-237f-0.MAI, EstimatedImpact: 0%
2026-07-31T12:23:22.803 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 75, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-07-31T12:23:22.803 ProcessImageName: cmd.exe, Pid: 8016, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0%
2026-07-31T12:23:22.803 ProcessImageName: powershell.exe, Pid: 3664, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp32E4.tmp, EstimatedImpact: 0%
2026-07-31T12:23:22.803 ProcessImageName: mysqldump.exe, Pid: 8228, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 18%
2026-07-31T12:23:22.803 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-07-31T12:24:17.443 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T12:31:42.224 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T12:31:42.224 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T12:31:42.224 [Cloud] Queued cloud request.
2026-07-31T12:31:42.224 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T12:31:42.224 [Cloud] Dequeued cloud request.
2026-07-31T12:31:42.224 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T12:31:42.427 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{821D5E76-94B9-9E29-77BC-65894FF8DCC9}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 12:31:42
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T12:31:42.943 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T12:34:45.224 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T12:34:45.224 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T12:34:45.224 [Cloud] Queued cloud request.
2026-07-31T12:34:45.224 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T12:34:45.224 [Cloud] Dequeued cloud request.
2026-07-31T12:34:45.224 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T12:34:45.412 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{034917B6-AC46-6F6D-B4B0-6B6D6D84FFCB}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 12:34:45
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T12:34:45.927 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T12:39:22.443 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T12:46:53.005 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T12:46:53.005 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T12:46:53.005 [Cloud] Queued cloud request.
2026-07-31T12:46:53.005 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T12:46:53.005 [Cloud] Dequeued cloud request.
2026-07-31T12:46:53.005 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T12:46:53.161 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9C7BE7A8-F8B8-3EAC-F709-746A7745B098}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 12:46:53
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T12:46:53.661 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T12:54:27.443 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T13:00:24.989 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T13:00:25.005 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T13:00:25.005 [Cloud] Queued cloud request.
2026-07-31T13:00:25.005 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T13:00:25.005 [Cloud] Dequeued cloud request.
2026-07-31T13:00:25.005 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T13:00:25.208 [Cloud] End of cloud request.
2026-07-31T13:00:25.708 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T13:03:58.067 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T13:03:58.067 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T13:03:58.067 [Cloud] Queued cloud request.
2026-07-31T13:03:58.067 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T13:03:58.067 [Cloud] Dequeued cloud request.
2026-07-31T13:03:58.083 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T13:03:58.255 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{DFFBD42E-61DB-A09F-C743-1F94650E44F7}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 13:03:58
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T13:03:58.755 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T13:06:38.817 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T13:06:38.817 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T13:06:38.817 [Cloud] Queued cloud request.
2026-07-31T13:06:38.817 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T13:06:38.817 [Cloud] Dequeued cloud request.
2026-07-31T13:06:38.833 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T13:06:39.005 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4E3539E0-AE1C-0183-6E49-9E4147B81956}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 13:06:39
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T13:06:39.520 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T13:09:32.442 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T13:10:06.223 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T13:10:06.223 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T13:10:06.223 [Cloud] Queued cloud request.
2026-07-31T13:10:06.223 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T13:10:06.223 [Cloud] Dequeued cloud request.
2026-07-31T13:10:06.223 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T13:10:06.567 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4174C3E5-1F95-7674-8484-C16884E8B81E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 13:10:06
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T13:10:07.083 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T13:16:10.302 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T13:16:10.302 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T13:16:10.302 [Cloud] Queued cloud request.
2026-07-31T13:16:10.302 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T13:16:10.302 [Cloud] Dequeued cloud request.
2026-07-31T13:16:10.302 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T13:16:10.536 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{8B7A1BA0-F47A-3ED3-F204-C6FA2E0D4F50}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 13:16:10
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T13:16:11.052 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T13:24:02.692 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T13:24:02.692 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T13:24:02.692 [Cloud] Queued cloud request.
2026-07-31T13:24:02.692 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T13:24:02.708 [Cloud] Dequeued cloud request.
2026-07-31T13:24:02.708 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T13:24:02.895 [Cloud] End of cloud request.
2026-07-31T13:24:03.395 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T13:24:37.442 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T13:27:04.348 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T13:27:04.348 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T13:27:04.348 [Cloud] Queued cloud request.
2026-07-31T13:27:04.348 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T13:27:04.348 [Cloud] Dequeued cloud request.
2026-07-31T13:27:04.348 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T13:27:04.614 [Cloud] End of cloud request.
2026-07-31T13:27:05.114 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T13:39:42.442 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T13:42:05.114 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T13:42:05.114 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T13:42:05.114 [Cloud] Queued cloud request.
2026-07-31T13:42:05.114 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T13:42:05.114 [Cloud] Dequeued cloud request.
2026-07-31T13:42:05.114 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T13:42:05.317 [Cloud] End of cloud request.
2026-07-31T13:42:05.817 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T13:44:53.926 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T13:44:53.926 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T13:44:53.926 [Cloud] Queued cloud request.
2026-07-31T13:44:53.926 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T13:44:53.926 [Cloud] Dequeued cloud request.
2026-07-31T13:44:53.926 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T13:44:54.426 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{6814DF47-234E-8D03-D4B2-6610ECC53B49}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 13:44:54
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T13:44:54.942 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T13:45:30.317 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T13:45:30.317 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T13:45:30.317 [Cloud] Queued cloud request.
2026-07-31T13:45:30.317 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T13:45:30.317 [Cloud] Dequeued cloud request.
2026-07-31T13:45:30.332 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T13:45:30.410 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{92B3A66F-A308-17AA-E53E-089CFF84A987}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 13:45:30
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T13:45:30.926 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T13:54:47.441 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T13:58:09.801 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T13:58:09.801 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T13:58:09.801 [Cloud] Queued cloud request.
2026-07-31T13:58:09.801 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T13:58:09.801 [Cloud] Dequeued cloud request.
2026-07-31T13:58:09.801 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T13:58:10.004 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{A96CFAB9-6006-7615-8CFE-E8F677BDBFD5}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 13:58:10
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T13:58:10.504 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T14:05:51.332 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T14:05:51.332 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T14:05:51.332 [Cloud] Queued cloud request.
2026-07-31T14:05:51.332 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T14:05:51.332 [Cloud] Dequeued cloud request.
2026-07-31T14:05:51.332 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T14:05:51.535 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{5187B263-65EC-6E46-5064-FD4E4C0C1A26}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 14:05:51
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T14:05:52.051 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T14:09:52.441 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T14:17:27.316 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T14:17:27.316 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T14:17:27.316 [Cloud] Queued cloud request.
2026-07-31T14:17:27.316 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T14:17:27.316 [Cloud] Dequeued cloud request.
2026-07-31T14:17:27.316 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T14:17:27.535 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{156F25D1-4287-23C7-0076-4D22374D407B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 14:17:27
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T14:17:28.035 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T14:22:37.441 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3
2026-07-31T14:22:37.472 Job Notification: New process added to job (5800)
2026-07-31T14:22:37.472 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched
2026-07-31T14:22:37.472 Aggressive catchup quick scan threshold: 489533903451 / 25920000000000
2026-07-31T14:22:37.488 Job Notification: New process added to job (8608)
2026-07-31T14:22:37.488 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26060.3008-0\MpCmdRun.exe][Pid:5800] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:8608]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4]
2026-07-31T14:22:37.613 Job Notification: New process added to job (6356)
2026-07-31T14:22:37.628 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched
2026-07-31T14:22:37.628 Job Notification: New process added to job (7020)
2026-07-31T14:22:37.644 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26060.3008-0\MpCmdRun.exe][Pid:6356] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7020]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4]
2026-07-31T14:22:37.972 [RTP] [RtpConfig] Config change detected, type: 32
2026-07-31T14:22:37.972 [RTP] Duplicating the current plugin configuration object...
2026-07-31T14:22:37.972 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ...
2026-07-31T14:22:37.972 [RTP] Updating plugin configuration due to recent config changes (0x20) ...
2026-07-31T14:22:37.972 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-07-31T14:22:37.972 [RTP] No config change detected. Not updating plugin configuration.
2026-07-31T14:22:37.972 [RTP] No config changes found. No configuration switch.
2026-07-31T14:22:37.972 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0
2026-07-31T14:23:12.081 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\030D38F7-2DA4-429A-9700-EA99CD0D99CC1b80.1dd20f81c9bf162
2026-07-31T14:23:12.144 Verifying engine and signature files (source: 0) ...
2026-07-31T14:23:12.144 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B786FD71-C5AC-4647-90B0-905FDBDB3F32}\mpengine.dll] due to PPL.
2026-07-31T14:23:12.144 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B786FD71-C5AC-4647-90B0-905FDBDB3F32}\mpasbase.vdm]. File not in cache (0x1)
2026-07-31T14:23:13.191 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B786FD71-C5AC-4647-90B0-905FDBDB3F32}\mpasbase.vdm]
2026-07-31T14:23:13.191 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B786FD71-C5AC-4647-90B0-905FDBDB3F32}\mpasdlta.vdm]. File not in cache (0x1)
2026-07-31T14:23:13.222 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B786FD71-C5AC-4647-90B0-905FDBDB3F32}\mpasdlta.vdm]
2026-07-31T14:23:13.222 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B786FD71-C5AC-4647-90B0-905FDBDB3F32}\mpavbase.vdm]. File not in cache (0x1)
2026-07-31T14:23:13.675 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B786FD71-C5AC-4647-90B0-905FDBDB3F32}\mpavbase.vdm]
2026-07-31T14:23:13.675 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B786FD71-C5AC-4647-90B0-905FDBDB3F32}\mpavdlta.vdm]. File not in cache (0x1)
2026-07-31T14:23:13.691 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B786FD71-C5AC-4647-90B0-905FDBDB3F32}\mpavdlta.vdm]
2026-07-31T14:23:13.910 [Engine] IsHybridMode: 0
2026-07-31T14:23:13.910 [KSL]KSL(1.1.26051.3007) Is available via CAMP. KslDevice : KslD
2026-07-31T14:23:13.925 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-EB15627C9D0BDD5F1384CD5E45839BE4A11B3AE4.bin): 0x00000002
2026-07-31T14:23:13.925 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-EB15627C9D0BDD5F1384CD5E45839BE4A11B3AE4.bin)
2026-07-31T14:23:13.925 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0
2026-07-31T14:23:13.925 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0
2026-07-31T14:23:13.925 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0
2026-07-31T14:23:13.925 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff
2026-07-31T14:23:22.816 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 34727, Count: 1490, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-07-31T14:23:22.816 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 16794, Count: 697, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-07-31T14:23:22.816 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 12505, Count: 714, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\inc\header.inc.php, EstimatedImpact: 0%
2026-07-31T14:23:22.816 ProcessImageName: powershell.exe, Pid: 6416, TotalTime: 1958, Count: 106, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 42%
2026-07-31T14:23:22.816 ProcessImageName: php.exe, Pid: 7044, TotalTime: 1361, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 38%
2026-07-31T14:23:22.816 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1100, Count: 56, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-07-31T14:23:22.816 ProcessImageName: AgentShellService.exe, Pid: 4956, TotalTime: 1037, Count: 31, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54%
2026-07-31T14:23:22.816 ProcessImageName: WmiPrvSE.exe, Pid: 7708, TotalTime: 861, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6%
2026-07-31T14:23:22.816 ProcessImageName: WmiPrvSE.exe, Pid: 776, TotalTime: 533, Count: 39, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 40%
2026-07-31T14:23:22.816 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 380, Count: 20, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-31T14:23:22.816 ProcessImageName: WmiPrvSE.exe, Pid: 5424, TotalTime: 356, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 0%
2026-07-31T14:23:22.816 ProcessImageName: powershell.exe, Pid: 3488, TotalTime: 355, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 39%
2026-07-31T14:23:22.816 ProcessImageName: python.exe, Pid: 8460, TotalTime: 272, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\renewal.py, EstimatedImpact: 10%
2026-07-31T14:23:22.816 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 232, Count: 4, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-07-31T14:23:22.816 ProcessImageName: ngentask.exe, Pid: 2428, TotalTime: 213, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 42%
2026-07-31T14:23:22.816 ProcessImageName: ngentask.exe, Pid: 7916, TotalTime: 166, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 37%
2026-07-31T14:23:22.816 ProcessImageName: cmd.exe, Pid: 7708, TotalTime: 155, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 100%
2026-07-31T14:23:22.816 ProcessImageName: python.exe, Pid: 5512, TotalTime: 139, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\renewal.py, EstimatedImpact: 5%
2026-07-31T14:23:22.816 ProcessImageName: ngentask.exe, Pid: 8056, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 43%
2026-07-31T14:23:22.816 ProcessImageName: ngentask.exe, Pid: 1972, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 34%
2026-07-31T14:23:22.816 ProcessImageName: taskhostw.exe, Pid: 6120, TotalTime: 93, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 15%
2026-07-31T14:23:22.816 ProcessImageName: DeviceCensus.exe, Pid: 956, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 8%
2026-07-31T14:23:22.816 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 75, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-237f-0.MAI, EstimatedImpact: 0%
2026-07-31T14:23:22.816 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 75, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-07-31T14:23:22.816 ProcessImageName: cmd.exe, Pid: 8016, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0%
2026-07-31T14:23:22.816 ProcessImageName: powershell.exe, Pid: 3664, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp32E4.tmp, EstimatedImpact: 0%
2026-07-31T14:23:22.816 ProcessImageName: mysqldump.exe, Pid: 8228, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 18%
2026-07-31T14:23:22.816 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b
IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b
IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b
IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b
IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d
IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b
IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d
IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b
2026-07-31T14:23:26.863 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
2026-07-31T14:23:26.863 [AutoExclusion] Applied roles from cache.
2026-07-31T14:23:26.863 [AutoExclusion] Started roles monitoring.
IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b
IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4
IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b
IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4
IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4
IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b
IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b
IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b
IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b
IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpFc_Kernel_DoNotResetExcludeOnModify hr=0x8007007b
IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse
IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0
IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse
2026-07-31T14:23:26.972 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFA3B958AF0, lRefCount: 6, hr=0
2026-07-31T14:23:26.972 [Engine] New active engine 00007FFA3A758AF0 replacing engine 00007FFA3B958AF0. Number of active engines: 2
2026-07-31T14:23:27.019 EngineInit:Global ASOC is enabled
2026-07-31T14:23:27.019 EngineInit:ASOO is enabled for developer volumes
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-31T14:23:27.128 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-07-31T14:23:27.160 MpWriteUupSignatureVersion 1.455.440.0, hr = 0
2026-07-31T14:23:27.160 ForceSyncMoacInsertion config from engine is 0, hr = 0x0
2026-07-31T14:23:27.175 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit
2026-07-31T14:23:27.175 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0
2026-07-31T14:23:27.175 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)!
2026-07-31T14:23:27.175 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set.
2026-07-31T14:23:27.191 MpUpdateUpdateResiliencyConfiguration updated to 0
2026-07-31T14:23:27.191 [Plugin] Initializing RTP plugin state...
2026-07-31T14:23:27.191 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off.
2026-07-31T14:23:27.191 [RTP] 
****************************RTP Perf Log***************************
RTP Start:‎07‎-‎30‎-‎2026 16:23:23
Last Perf:‎07‎-‎30‎-‎2026 16:23:22
First RTP Scan:‎07‎-‎30‎-‎2026 16:23:23
Plugin States:  AV:1  AS:1  RTP:1  OA:1  BM:1
Process Exclusions:
Path Exclusions:
Ext Exclusions:
Temp Exclusions:
Worker Threads:
  AM:14
  Async:4
Cache Flushes:
  RTP:1
System File Cache:
  Hits:1412
  Misses:7180
BM Queue:0,984,0
  Proc:0,32,0
  File:0,982,0
Plugin Queue:0,2,0
  Threat:0,0,0
  Susp:0,2,0
  Unknown:0,0,0
  Error:0,0,0
Request Queue:1,3,0
  SetEngine:1,1,0
  SetState:0,0,0
  SetUser:0,0,0
  Config:0,1,0
  ProcExcl:0,1,0
  FilterReload:0,0,0
  FilterUnload:0,0,0
MpFilter:
  Scans:7686977
  Pending:0
  RegSize:309472
  AsyncQNotif:0
  AsyncQMissed:0
  AsyncQTotalSent:918786108
  AsyncQCurrent:0
  BMFlags:40095
  ServiceMaj:0
  ServiceMin:0
  NumInstance:3
  TotalStreamCon:6484
  NTFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:391904
   TotalHits:2929397
   InstanceCacheInserts:5585
   InstanceCacheUpdates:0
   InstanceCacheDeletes:4026
   InstanceCacheHits:1530
   InstanceCacheMisses:111050
   InstanceCacheOverflows:0
  CSVFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:0
   TotalHits:0
   InstanceCacheInserts:0
   InstanceCacheUpdates:0
   InstanceCacheDeletes:0
   InstanceCacheHits:0
   InstanceCacheMisses:0
   InstanceCacheOverflows:0
  REFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:0
   TotalHits:0
   InstanceCacheInserts:0
   InstanceCacheUpdates:0
   InstanceCacheDeletes:0
   InstanceCacheHits:0
   InstanceCacheMisses:0
   InstanceCacheOverflows:0
  SyncProcessCreateDuration:5ms (7802/1472)
   Success: 1472, failures: 0 (last code: 0x0), timeouts: 0,  baddata: 0
 
**************************END RTP Perf Log*************************

 
 

2026-07-31T14:23:27.191 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B786FD71-C5AC-4647-90B0-905FDBDB3F32}
2026-07-31T14:23:27.191 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D9313071-C0C3-4E1E-B28A-0CA3D0EFB7E2} removed
2026-07-31T14:23:27.191 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DAC923FD-89A8-4286-AA88-929B417E73D7}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DAC923FD-89A8-4286-AA88-929B417E73D7}\mpasbase.vdm in use, hr=0x80070020
2026-07-31T14:23:27.206 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f
2026-07-31T14:23:27.206 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f
2026-07-31T14:23:27.206 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f
2026-07-31T14:23:27.206 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0).
2026-07-31T14:23:27.206 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f
2026-07-31T14:23:27.206 MdCoreSvc is supported in this platform and OS
Beginning quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Target:
Flags:131074
Start time:07-31-2026 14:23:27
Finished quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Result:0
End time:07-31-2026 14:23:27
2026-07-31T14:23:27.206 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0
2026-07-31T14:23:27.206 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0
2026-07-31T14:23:27.206 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-07-31T14:23:27.206 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0).
BmLoggingDisabled:MpDisableBmLogging not set.
2026-07-31T14:23:27.206 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T14:23:27.206 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f
2026-07-31T14:23:27.206 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f
2026-07-31T14:23:27.206 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f
2026-07-31T14:23:27.206 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f
2026-07-31T14:23:27.206 MdCoreSvc is supported in this platform and OS
Signature updated on 07-31-2026 14:23:27
Product Version: 4.18.26060.3008
Service Version: 4.18.26060.3008
Engine Version: 1.1.26060.3008
AS Signature Version: 1.455.440.0
AV Signature Version: 1.455.440.0
************************************************************
2026-07-31T14:23:27.222 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0
2026-07-31T14:23:27.222 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\030D38F7-2DA4-429A-9700-EA99CD0D99CC1b80.1dd20f81c9bf162
2026-07-31T14:23:27.269 Process scan (postsignatureupdatescan) started.
2026-07-31T14:23:27.269 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True
2026-07-31T14:23:27.269 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0
Signature updated via MicrosoftUpdateServer on 07-31-2026 14:23:27
************************************************************
2026-07-31T14:23:27.425 Job Notification: Process exited from job (6356)
2026-07-31T14:23:27.441 Job Notification: Process exited from job (5800)
2026-07-31T14:23:27.441 Job Notification: Process exited from job (7020)
2026-07-31T14:23:27.456 Job Notification: Process exited from job (8608)
2026-07-31T14:23:27.605 [RTP] Setting RegLinkHardeningMode to 1 (hr=0).
2026-07-31T14:23:27.605 [RTP] Setting EfsHardeningFlags to 0 (hr=0).
2026-07-31T14:23:27.613 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0).
2026-07-31T14:23:27.613 [RTP] PreventPagingFileAbuseKillbit[0].
2026-07-31T14:23:27.613 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0).
2026-07-31T14:23:27.613 [Engine] Engine 00007FFA3B958AF0 no longer in use. Number of active engines: 1
2026-07-31T14:23:27.613 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-07-31T14:23:27.613 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0).
2026-07-31T14:23:27.675 [KSL] Entering CKSLEngine::EnableKSL. State: [3]
2026-07-31T14:23:27.675 [KSL] CKSLEngine::EnableKSL feature is already enabled.
2026-07-31T14:23:27.675 [KSL] Leaving CKSLEngine::EnableKsl(0).
2026-07-31T14:23:28.066 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 34727, Count: 1490, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-07-31T14:23:28.066 ProcessImageName: AgentShell.exe, Pid: 6032, TotalTime: 16794, Count: 697, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-07-31T14:23:28.066 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 12505, Count: 714, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\inc\header.inc.php, EstimatedImpact: 0%
2026-07-31T14:23:28.066 ProcessImageName: powershell.exe, Pid: 6416, TotalTime: 1958, Count: 106, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 42%
2026-07-31T14:23:28.066 ProcessImageName: php.exe, Pid: 7044, TotalTime: 1361, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 38%
2026-07-31T14:23:28.066 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1100, Count: 56, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-07-31T14:23:28.066 ProcessImageName: AgentShellService.exe, Pid: 4956, TotalTime: 1037, Count: 31, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54%
2026-07-31T14:23:28.066 ProcessImageName: WmiPrvSE.exe, Pid: 7708, TotalTime: 861, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6%
2026-07-31T14:23:28.066 ProcessImageName: WmiPrvSE.exe, Pid: 776, TotalTime: 533, Count: 39, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 40%
2026-07-31T14:23:28.066 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 380, Count: 20, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-31T14:23:28.066 ProcessImageName: WmiPrvSE.exe, Pid: 5424, TotalTime: 356, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 0%
2026-07-31T14:23:28.066 ProcessImageName: powershell.exe, Pid: 3488, TotalTime: 355, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 39%
2026-07-31T14:23:28.066 ProcessImageName: python.exe, Pid: 8460, TotalTime: 272, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\renewal.py, EstimatedImpact: 10%
2026-07-31T14:23:28.066 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 232, Count: 4, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-07-31T14:23:28.066 ProcessImageName: ngentask.exe, Pid: 2428, TotalTime: 213, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 42%
2026-07-31T14:23:28.144 [Engine] RSIG_UNLOADENGINE, 00007FFA3B958AF0, err=0x0
2026-07-31T14:23:28.160 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DAC923FD-89A8-4286-AA88-929B417E73D7} removed
2026-07-31T14:23:45.628 Process scan (postsignatureupdatescan) completed.
2026-07-31T14:24:57.441 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T14:26:36.831 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T14:26:36.831 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T14:26:36.831 [Cloud] Queued cloud request.
2026-07-31T14:26:36.831 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T14:26:36.831 [Cloud] Dequeued cloud request.
2026-07-31T14:26:36.831 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T14:26:37.019 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2CB6DA11-279A-4CBE-93E7-54D2A22A8ED8}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 14:26:37
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T14:26:37.535 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T14:26:55.113 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T14:26:55.113 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T14:26:55.113 [Cloud] Queued cloud request.
2026-07-31T14:26:55.113 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T14:26:55.113 [Cloud] Dequeued cloud request.
2026-07-31T14:26:55.113 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T14:26:55.191 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F3B67F62-DF80-80EB-68E2-DD7E8A3B149E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 14:26:55
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T14:26:55.691 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T14:28:08.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T14:28:08.097 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T14:28:08.097 [Cloud] Queued cloud request.
2026-07-31T14:28:08.097 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T14:28:08.113 [Cloud] Dequeued cloud request.
2026-07-31T14:28:08.113 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T14:28:08.269 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{965D8894-09B3-054D-C6FA-9AC8EDB8432E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 14:28:08
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T14:28:08.769 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T14:28:27.034 [RbM] Setting Last known good engine candidate. hr = 0
2026-07-31T14:39:10.847 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T14:39:10.847 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T14:39:10.847 [Cloud] Queued cloud request.
2026-07-31T14:39:10.847 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T14:39:10.847 [Cloud] Dequeued cloud request.
2026-07-31T14:39:10.847 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T14:39:11.066 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{989A3341-F857-BFF7-F07A-4313A2F33D4B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 14:39:11
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T14:39:11.581 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T14:40:02.441 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T14:42:07.237 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T14:42:07.237 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T14:42:07.237 [Cloud] Queued cloud request.
2026-07-31T14:42:07.237 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T14:42:07.237 [Cloud] Dequeued cloud request.
2026-07-31T14:42:07.237 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T14:42:07.425 [Cloud] End of cloud request.
2026-07-31T14:42:07.925 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T14:46:03.925 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T14:46:03.925 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T14:46:03.925 [Cloud] Queued cloud request.
2026-07-31T14:46:03.925 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T14:46:03.925 [Cloud] Dequeued cloud request.
2026-07-31T14:46:03.925 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T14:46:04.112 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{551E432E-7F04-3030-3DCA-BA80C406B53A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 14:46:04
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T14:46:04.628 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T14:50:14.847 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T14:50:14.847 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T14:50:14.847 [Cloud] Queued cloud request.
2026-07-31T14:50:14.847 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T14:50:15.081 [Cloud] Dequeued cloud request.
2026-07-31T14:50:15.284 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T14:50:15.472 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F7CF2B79-DAE9-B417-6F62-74EC4CC8D9EC}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 14:50:15
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T14:50:15.972 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T14:55:07.440 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T14:57:53.503 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T14:57:53.503 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T14:57:53.503 [Cloud] Queued cloud request.
2026-07-31T14:57:53.503 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T14:57:53.503 [Cloud] Dequeued cloud request.
2026-07-31T14:57:53.503 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T14:57:53.706 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{5DEADF62-D5E2-3E6E-2F0C-91AEBF4B25CB}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 14:57:53
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T14:57:54.206 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T15:04:52.971 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T15:04:52.971 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T15:04:52.971 [Cloud] Queued cloud request.
2026-07-31T15:04:52.971 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T15:04:52.971 [Cloud] Dequeued cloud request.
2026-07-31T15:04:52.971 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T15:04:53.159 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2DDB7E96-E447-CF94-53C1-55F22DEBEDF0}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 15:04:53
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T15:04:53.674 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T15:10:12.440 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T15:18:39.533 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T15:18:39.533 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T15:18:39.533 [Cloud] Queued cloud request.
2026-07-31T15:18:39.533 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T15:18:39.533 [Cloud] Dequeued cloud request.
2026-07-31T15:18:39.533 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T15:18:39.768 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4FB40186-8E12-9B41-1788-B7AC6EFEFAB8}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 15:18:39
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T15:18:40.283 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T15:22:18.221 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T15:22:18.221 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T15:22:18.221 [Cloud] Queued cloud request.
2026-07-31T15:22:18.221 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T15:22:18.221 [Cloud] Dequeued cloud request.
2026-07-31T15:22:18.221 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T15:22:18.408 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F7AC4737-684C-40A2-D498-17F9B6244459}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 15:22:18
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T15:22:18.908 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T15:25:17.440 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T15:29:24.252 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T15:29:24.252 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T15:29:24.252 [Cloud] Queued cloud request.
2026-07-31T15:29:24.252 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T15:29:24.252 [Cloud] Dequeued cloud request.
2026-07-31T15:29:24.252 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T15:29:24.455 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1D9CD4A1-6FB4-9BEE-24E0-4AB810B9DA8D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 15:29:24
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T15:29:24.955 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T15:33:05.908 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T15:33:05.908 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T15:33:05.908 [Cloud] Queued cloud request.
2026-07-31T15:33:05.908 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T15:33:05.908 [Cloud] Dequeued cloud request.
2026-07-31T15:33:05.908 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T15:33:06.096 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{EA425AB7-1AFB-69EA-FFEA-A0E2DD97AE44}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 15:33:06
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T15:33:06.596 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T15:34:27.314 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T15:34:27.314 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T15:34:27.314 [Cloud] Queued cloud request.
2026-07-31T15:34:27.314 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T15:34:27.314 [Cloud] Dequeued cloud request.
2026-07-31T15:34:27.314 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T15:34:27.518 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{21641CD6-EDD9-DE6C-D819-E0979C83BA27}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 15:34:27
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T15:34:28.033 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T15:40:22.439 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T15:43:58.877 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T15:43:58.877 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T15:43:58.877 [Cloud] Queued cloud request.
2026-07-31T15:43:58.877 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T15:43:58.877 [Cloud] Dequeued cloud request.
2026-07-31T15:43:58.877 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T15:43:59.064 [Cloud] End of cloud request.
2026-07-31T15:43:59.564 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T15:46:59.392 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T15:46:59.392 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T15:46:59.392 [Cloud] Queued cloud request.
2026-07-31T15:46:59.392 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T15:46:59.392 [Cloud] Dequeued cloud request.
2026-07-31T15:46:59.392 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T15:46:59.596 [Cloud] End of cloud request.
2026-07-31T15:47:00.096 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T15:48:01.736 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T15:48:01.736 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T15:48:01.736 [Cloud] Queued cloud request.
2026-07-31T15:48:01.736 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T15:48:01.736 [Cloud] Dequeued cloud request.
2026-07-31T15:48:01.736 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T15:48:01.923 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{7374B3BC-9CA2-DB04-3A81-D011FAE6445B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 15:48:01
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T15:48:02.439 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T15:51:15.548 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T15:51:15.548 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T15:51:15.548 [Cloud] Queued cloud request.
2026-07-31T15:51:15.548 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T15:51:15.548 [Cloud] Dequeued cloud request.
2026-07-31T15:51:15.548 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T15:51:15.783 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{876A8AE7-466F-A17D-3D5F-6CA9F2E86AC5}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 15:51:15
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T15:51:16.283 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T15:55:27.439 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T16:10:32.439 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T16:16:17.064 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\$Extend\$Deleted\0029000000037BE207C7C0E8. Process: \Device\HarddiskVolume2\Windows\System32\svchost.exe, Status: 0xc0000001, State: 0, ScanRequest #7724460, FileId: 0x29000000037be2, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x2000, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T16:18:07.845 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T16:18:07.845 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T16:18:07.845 [Cloud] Queued cloud request.
2026-07-31T16:18:07.845 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T16:18:07.845 [Cloud] Dequeued cloud request.
2026-07-31T16:18:07.845 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T16:18:08.063 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{6FF95FAE-AD56-98EF-ABFA-EFAF6D51B5FA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 16:18:08
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T16:18:08.564 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T16:18:47.314 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T16:18:47.314 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T16:18:47.314 [Cloud] Queued cloud request.
2026-07-31T16:18:47.314 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T16:18:47.314 [Cloud] Dequeued cloud request.
2026-07-31T16:18:47.314 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T16:18:47.392 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{D9B7AC09-5D6A-F1B8-2EAB-93D420948BD9}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 16:18:47
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T16:18:47.892 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T16:20:34.439 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T16:20:34.439 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T16:20:34.439 [Cloud] Queued cloud request.
2026-07-31T16:20:34.439 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T16:20:34.439 [Cloud] Dequeued cloud request.
2026-07-31T16:20:34.439 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T16:20:34.610 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{219B9925-2CEC-F094-8725-4FA743205888}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 16:20:34
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T16:20:35.110 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T16:22:58.954 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T16:22:58.954 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T16:22:58.954 [Cloud] Queued cloud request.
2026-07-31T16:22:58.954 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T16:22:58.954 [Cloud] Dequeued cloud request.
2026-07-31T16:22:58.954 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T16:22:59.204 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{D9B9D474-8416-CFAD-8F69-E2A5943C7892}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 16:22:59
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T16:22:59.720 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T16:23:26.970 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 4559, Count: 166, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-07-31T16:23:26.970 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 2310, Count: 125, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\login.php, EstimatedImpact: 0%
2026-07-31T16:23:26.970 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 122, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0%
2026-07-31T16:23:26.970 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemResources\shsvcs.dll.mun, EstimatedImpact: 0%
2026-07-31T16:23:26.970 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-07-31T16:25:37.438 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T16:40:42.438 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T16:50:40.626 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T16:50:40.626 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T16:50:40.626 [Cloud] Queued cloud request.
2026-07-31T16:50:40.626 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T16:50:40.626 [Cloud] Dequeued cloud request.
2026-07-31T16:50:40.626 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T16:50:40.782 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{FC487B67-EC55-491D-9DB2-2D36C19F7EC7}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 16:50:40
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T16:50:41.282 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T16:55:47.438 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T17:07:14.563 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T17:07:14.563 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T17:07:14.563 [Cloud] Queued cloud request.
2026-07-31T17:07:14.563 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T17:07:14.563 [Cloud] Dequeued cloud request.
2026-07-31T17:07:14.563 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T17:07:14.766 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9B8768B4-9D7C-85D7-0380-F1C86A661094}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 17:07:14
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T17:07:15.266 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T17:10:40.813 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T17:10:40.813 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T17:10:40.813 [Cloud] Queued cloud request.
2026-07-31T17:10:40.813 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T17:10:40.813 [Cloud] Dequeued cloud request.
2026-07-31T17:10:40.813 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T17:10:41.000 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1042FF78-5C0C-A900-761E-F20FF5F40C65}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 17:10:41
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T17:10:41.500 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T17:10:52.438 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T17:19:05.469 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T17:19:05.469 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T17:19:05.469 [Cloud] Queued cloud request.
2026-07-31T17:19:05.469 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T17:19:05.469 [Cloud] Dequeued cloud request.
2026-07-31T17:19:05.469 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T17:19:05.672 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{3B0FE598-E9F4-2CAA-67E1-5F8603C9DE2E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 17:19:05
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T17:19:06.172 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T17:22:10.344 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T17:22:10.360 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T17:22:10.360 [Cloud] Queued cloud request.
2026-07-31T17:22:10.360 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T17:22:10.360 [Cloud] Dequeued cloud request.
2026-07-31T17:22:10.360 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T17:22:10.532 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{554DF857-8DCA-5F44-1292-003C1606757D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 17:22:10
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T17:22:11.047 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T17:25:57.438 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T17:36:59.015 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T17:36:59.015 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T17:36:59.015 [Cloud] Queued cloud request.
2026-07-31T17:36:59.015 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T17:36:59.015 [Cloud] Dequeued cloud request.
2026-07-31T17:36:59.015 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T17:36:59.234 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{811730A5-32F1-EA74-08FF-AACD6AADA4BD}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 17:36:59
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T17:36:59.734 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T17:41:02.437 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T17:45:41.062 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T17:45:41.062 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T17:45:41.062 [Cloud] Queued cloud request.
2026-07-31T17:45:41.062 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T17:45:41.062 [Cloud] Dequeued cloud request.
2026-07-31T17:45:41.062 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T17:45:41.250 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{D179A9F3-919B-2BD4-53D3-F00CAB6A873F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 17:45:41
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T17:45:41.765 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T17:46:49.765 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T17:46:49.765 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T17:46:49.765 [Cloud] Queued cloud request.
2026-07-31T17:46:49.765 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T17:46:49.765 [Cloud] Dequeued cloud request.
2026-07-31T17:46:49.765 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T17:46:49.969 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9E0ED921-01E1-6ADB-B5BF-C5C2C1C062A9}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 17:46:49
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T17:46:50.484 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T17:56:07.437 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T17:58:09.281 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T17:58:09.281 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T17:58:09.281 [Cloud] Queued cloud request.
2026-07-31T17:58:09.281 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T17:58:09.281 [Cloud] Dequeued cloud request.
2026-07-31T17:58:09.281 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T17:58:09.484 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1CF7945E-E4F1-FE5A-F706-60041D7CD047}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 17:58:09
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T17:58:09.984 [NRI] Successfully updated NIS service with platform settings for enforcement level Log

BEGIN BM telemetry
GUID:{DB086E70-ED84-EF18-2D3F-2DD899030C8C}
SignatureID:55746285003867
SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df
ThreatLevel:0
ProcessID:2852
ProcessCreationTime:134285983332457305
SessionID:0
CreationTime:07-31-2026 17:59:01
ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T17:59:02.765 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T17:59:02.765 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T17:59:02.765 [Cloud] Queued cloud request.
2026-07-31T17:59:02.765 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T17:59:02.765 [Cloud] Dequeued cloud request.
2026-07-31T17:59:02.765 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T17:59:02.999 [Cloud] End of cloud request.
2026-07-31T17:59:03.515 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T17:59:04.546 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T17:59:04.546 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T17:59:04.546 [Cloud] Queued cloud request.
2026-07-31T17:59:04.546 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T17:59:04.546 [Cloud] Dequeued cloud request.
2026-07-31T17:59:04.546 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T17:59:04.624 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4BF3C427-1583-1AF7-47BD-D845745040C3}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 17:59:04
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T17:59:05.140 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T18:08:12.359 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T18:08:12.359 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T18:08:12.359 [Cloud] Queued cloud request.
2026-07-31T18:08:12.359 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T18:08:12.359 [Cloud] Dequeued cloud request.
2026-07-31T18:08:12.359 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T18:08:12.562 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{A9A3089E-A688-244E-B158-85506C8E88B3}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 18:08:12
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T18:08:13.077 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T18:11:12.437 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T18:14:45.187 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T18:14:45.187 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T18:14:45.187 [Cloud] Queued cloud request.
2026-07-31T18:14:45.187 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T18:14:45.187 [Cloud] Dequeued cloud request.
2026-07-31T18:14:45.187 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T18:14:45.327 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{95A125A6-07A9-59F9-6E3D-78B564025C51}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 18:14:45
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T18:14:45.843 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T18:19:15.905 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T18:19:15.905 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T18:19:15.905 [Cloud] Queued cloud request.
2026-07-31T18:19:15.905 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T18:19:15.905 [Cloud] Dequeued cloud request.
2026-07-31T18:19:15.921 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T18:19:16.062 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{C3BC6A4A-2A97-147A-BE75-0DD23773D2C6}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 18:19:16
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T18:19:16.562 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T18:23:16.390 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T18:23:16.390 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T18:23:16.390 [Cloud] Queued cloud request.
2026-07-31T18:23:16.390 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T18:23:16.390 [Cloud] Dequeued cloud request.
2026-07-31T18:23:16.390 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T18:23:16.546 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2DDA608D-CBB5-53B2-77E8-6DD0240D2F77}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 18:23:16
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T18:23:17.062 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T18:23:26.968 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 9412, Count: 336, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-07-31T18:23:26.968 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 2540, Count: 133, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\login.php, EstimatedImpact: 0%
2026-07-31T18:23:26.968 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 198, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0%
2026-07-31T18:23:26.968 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemResources\shsvcs.dll.mun, EstimatedImpact: 0%
2026-07-31T18:23:26.968 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-07-31T18:23:26.968 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-31T18:25:58.218 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T18:25:58.218 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T18:25:58.218 [Cloud] Queued cloud request.
2026-07-31T18:25:58.218 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T18:25:58.218 [Cloud] Dequeued cloud request.
2026-07-31T18:25:58.218 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T18:25:58.421 [Cloud] End of cloud request.
2026-07-31T18:25:58.921 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T18:26:17.437 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T18:41:22.436 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T18:56:27.436 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T19:11:32.436 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T19:24:28.920 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T19:24:28.920 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T19:24:28.920 [Cloud] Queued cloud request.
2026-07-31T19:24:28.920 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T19:24:28.920 [Cloud] Dequeued cloud request.
2026-07-31T19:24:28.920 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T19:24:29.076 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E50B12A4-4B2E-F388-E3D0-7B6616E0921B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 19:24:29
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T19:24:29.576 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T19:25:56.873 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T19:25:56.873 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T19:25:56.873 [Cloud] Queued cloud request.
2026-07-31T19:25:56.873 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T19:25:56.873 [Cloud] Dequeued cloud request.
2026-07-31T19:25:56.873 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T19:25:57.014 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{B49DF3C3-1925-E476-CBA6-0D3C459750C6}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 19:25:57
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T19:25:57.514 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T19:26:37.435 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T19:41:42.435 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T19:41:49.514 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T19:41:49.514 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T19:41:49.514 [Cloud] Queued cloud request.
2026-07-31T19:41:49.514 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T19:41:49.514 [Cloud] Dequeued cloud request.
2026-07-31T19:41:49.514 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T19:41:49.717 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{036AE991-960A-929E-D4D8-D08BAA452CFF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 19:41:49
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T19:41:50.217 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T19:49:47.201 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T19:49:47.201 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T19:49:47.201 [Cloud] Queued cloud request.
2026-07-31T19:49:47.201 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T19:49:47.201 [Cloud] Dequeued cloud request.
2026-07-31T19:49:47.201 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T19:49:47.388 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4C01CB10-CF2E-F4AD-C966-E0FE4EBEE278}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 19:49:47
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T19:49:47.904 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T19:52:00.341 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T19:52:00.341 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T19:52:00.341 [Cloud] Queued cloud request.
2026-07-31T19:52:00.341 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T19:52:00.341 [Cloud] Dequeued cloud request.
2026-07-31T19:52:00.341 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T19:52:00.529 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{B980C8DC-89B8-8F17-7BC9-6ED1D84FB0AA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 19:52:00
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T19:52:01.044 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T19:52:20.654 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T19:52:20.654 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T19:52:20.654 [Cloud] Queued cloud request.
2026-07-31T19:52:20.654 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T19:52:20.654 [Cloud] Dequeued cloud request.
2026-07-31T19:52:20.654 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T19:52:20.732 [Cloud] End of cloud request.
2026-07-31T19:52:21.232 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T19:55:21.544 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T19:55:21.544 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T19:55:21.544 [Cloud] Queued cloud request.
2026-07-31T19:55:21.544 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T19:55:21.544 [Cloud] Dequeued cloud request.
2026-07-31T19:55:21.544 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T19:55:21.716 [Cloud] End of cloud request.
2026-07-31T19:55:22.216 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T19:56:07.638 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T19:56:07.638 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T19:56:07.638 [Cloud] Queued cloud request.
2026-07-31T19:56:07.638 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T19:56:07.638 [Cloud] Dequeued cloud request.
2026-07-31T19:56:07.638 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T19:56:07.716 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{3F64B144-468F-1000-AE67-EA560B04F971}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 19:56:07
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T19:56:08.216 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T19:56:47.435 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T20:07:56.544 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T20:07:56.544 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T20:07:56.544 [Cloud] Queued cloud request.
2026-07-31T20:07:56.544 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T20:07:56.544 [Cloud] Dequeued cloud request.
2026-07-31T20:07:56.560 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T20:07:56.716 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F72784E8-9C74-C37C-0547-A59CDD153FC8}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 20:07:56
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T20:07:57.216 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T20:10:22.654 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T20:10:22.654 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T20:10:22.654 [Cloud] Queued cloud request.
2026-07-31T20:10:22.654 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T20:10:22.654 [Cloud] Dequeued cloud request.
2026-07-31T20:10:22.654 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T20:10:22.810 [Cloud] End of cloud request.
2026-07-31T20:10:23.310 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T20:11:52.435 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T20:23:26.981 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 14013, Count: 513, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-07-31T20:23:26.981 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 6890, Count: 366, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\googlemaps\Wienerberg_20060501.html, EstimatedImpact: 0%
2026-07-31T20:23:26.981 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 228, Count: 12, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0%
2026-07-31T20:23:26.981 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemResources\shsvcs.dll.mun, EstimatedImpact: 0%
2026-07-31T20:23:26.981 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 91, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24a6-0.MAI, EstimatedImpact: 0%
2026-07-31T20:23:26.981 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 75, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-31T20:23:26.981 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-07-31T20:25:53.075 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T20:25:53.075 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T20:25:53.075 [Cloud] Queued cloud request.
2026-07-31T20:25:53.075 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T20:25:53.075 [Cloud] Dequeued cloud request.
2026-07-31T20:25:53.075 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T20:25:53.231 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{7279A77B-7013-117E-AB3B-27D4CCE32A3A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 20:25:53
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T20:25:53.731 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T20:26:57.434 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T20:42:02.434 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T20:47:42.700 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T20:47:42.700 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T20:47:42.700 [Cloud] Queued cloud request.
2026-07-31T20:47:42.700 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T20:47:42.700 [Cloud] Dequeued cloud request.
2026-07-31T20:47:42.700 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T20:47:42.872 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{CD93BD51-84DD-F1F5-99F8-84D0A97C1E66}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 20:47:42
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T20:47:43.372 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T20:57:07.434 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T21:07:38.653 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T21:07:38.653 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T21:07:38.653 [Cloud] Queued cloud request.
2026-07-31T21:07:38.653 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T21:07:38.653 [Cloud] Dequeued cloud request.
2026-07-31T21:07:38.653 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T21:07:38.809 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{87179EF3-73AD-3F59-DAF9-06E7184C84F4}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 21:07:38
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T21:07:39.324 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T21:12:12.434 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T21:18:58.856 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T21:18:58.856 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T21:18:58.856 [Cloud] Queued cloud request.
2026-07-31T21:18:58.856 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T21:18:58.856 [Cloud] Dequeued cloud request.
2026-07-31T21:18:58.856 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T21:18:59.027 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{FF63F0DB-99F8-A776-CBC7-D293FB97189D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 21:18:59
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T21:18:59.543 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T21:21:44.027 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T21:21:44.027 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T21:21:44.027 [Cloud] Queued cloud request.
2026-07-31T21:21:44.027 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T21:21:44.027 [Cloud] Dequeued cloud request.
2026-07-31T21:21:44.027 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T21:21:44.184 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9A4D32DF-4E55-53DD-AFC1-4ED588F3CF61}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 21:21:44
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T21:21:44.684 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T21:23:23.590 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T21:23:23.590 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T21:23:23.590 [Cloud] Queued cloud request.
2026-07-31T21:23:23.590 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T21:23:23.590 [Cloud] Dequeued cloud request.
2026-07-31T21:23:23.590 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T21:23:23.746 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9C40464E-C62A-5C90-2CAA-1D9D74E21FAA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 21:23:23
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T21:23:24.246 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T21:24:20.059 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T21:24:20.059 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T21:24:20.059 [Cloud] Queued cloud request.
2026-07-31T21:24:20.059 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T21:24:20.059 [Cloud] Dequeued cloud request.
2026-07-31T21:24:20.059 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T21:24:20.387 [Cloud] End of cloud request.
2026-07-31T21:24:20.902 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T21:27:17.434 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T21:28:03.168 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T21:28:03.168 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T21:28:03.168 [Cloud] Queued cloud request.
2026-07-31T21:28:03.168 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T21:28:03.168 [Cloud] Dequeued cloud request.
2026-07-31T21:28:03.168 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T21:28:03.324 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{DC4B94ED-090F-F4A2-0E6D-EB6692F4E526}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 21:28:03
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T21:28:03.824 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T21:32:34.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T21:32:34.387 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T21:32:34.387 [Cloud] Queued cloud request.
2026-07-31T21:32:34.387 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T21:32:34.387 [Cloud] Dequeued cloud request.
2026-07-31T21:32:34.387 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T21:32:34.574 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{B9A72535-8E59-D1CB-92B7-FF17A8A2E5BF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 21:32:34
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T21:32:35.090 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T21:34:51.871 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T21:34:51.871 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T21:34:51.871 [Cloud] Queued cloud request.
2026-07-31T21:34:51.871 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T21:34:51.871 [Cloud] Dequeued cloud request.
2026-07-31T21:34:51.871 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T21:34:52.090 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{FA59C898-B6EF-B09A-8FF2-A455ED621A0C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 21:34:52
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T21:34:52.590 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T21:42:22.433 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T21:53:47.340 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T21:53:47.340 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T21:53:47.340 [Cloud] Queued cloud request.
2026-07-31T21:53:47.340 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T21:53:47.340 [Cloud] Dequeued cloud request.
2026-07-31T21:53:47.340 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T21:53:47.543 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{6E64C60B-9575-BB3D-3DF8-348053B75EC2}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 21:53:47
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T21:53:48.043 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T21:57:27.433 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T22:12:32.433 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T22:14:09.730 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\IDR_XML_DEFAULT_TRANSFORM[1]. Process: \Device\HarddiskVolume2\Windows\System32\taskhostw.exe, Status: 0xc0000001, State: 0, ScanRequest #7842896, FileId: 0x190000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0x3, DesiredAccess:0x0, FileAttributes:0x2020, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T22:22:17.433 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_jarirg3v.4vh.psm1. Process: \Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #7847024, FileId: 0x150000000c459d, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-07-31T22:23:26.980 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 18894, Count: 706, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-07-31T22:23:26.980 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 7276, Count: 380, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\googlemaps\Wienerberg_20060501.html, EstimatedImpact: 0%
2026-07-31T22:23:26.980 ProcessImageName: powershell.exe, Pid: 6020, TotalTime: 2069, Count: 106, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 39%
2026-07-31T22:23:26.980 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 1147, Count: 40, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 2%
2026-07-31T22:23:26.980 ProcessImageName: AgentShellService.exe, Pid: 1376, TotalTime: 1073, Count: 20, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 61%
2026-07-31T22:23:26.980 ProcessImageName: WmiPrvSE.exe, Pid: 5216, TotalTime: 1001, Count: 26, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 7%
2026-07-31T22:23:26.980 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 442, Count: 22, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0%
2026-07-31T22:23:26.980 ProcessImageName: WmiPrvSE.exe, Pid: 8536, TotalTime: 372, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\win32kbase.sys, EstimatedImpact: 0%
2026-07-31T22:23:26.980 ProcessImageName: ngentask.exe, Pid: 5544, TotalTime: 228, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 41%
2026-07-31T22:23:26.980 ProcessImageName: ngentask.exe, Pid: 1124, TotalTime: 150, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-07-31T22:23:26.980 ProcessImageName: ngentask.exe, Pid: 1328, TotalTime: 135, Count: 15, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19%
2026-07-31T22:23:26.980 ProcessImageName: ngentask.exe, Pid: 7164, TotalTime: 121, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 20%
2026-07-31T22:23:26.980 ProcessImageName: taskhostw.exe, Pid: 5416, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 17%
2026-07-31T22:23:26.980 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemResources\shsvcs.dll.mun, EstimatedImpact: 0%
2026-07-31T22:23:26.980 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 91, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24a6-0.MAI, EstimatedImpact: 0%
2026-07-31T22:23:26.980 ProcessImageName: powershell.exe, Pid: 1856, TotalTime: 91, Count: 6, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp8EF5.tmp, EstimatedImpact: 0%
2026-07-31T22:23:26.980 ProcessImageName: powershell.exe, Pid: 7320, TotalTime: 77, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp7EA9.tmp, EstimatedImpact: 0%
2026-07-31T22:23:26.980 ProcessImageName: taskhostw.exe, Pid: 8644, TotalTime: 76, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SYSTEM, EstimatedImpact: 1%
2026-07-31T22:23:26.980 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 75, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-07-31T22:23:26.980 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-07-31T22:27:30.933 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T22:27:30.933 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T22:27:30.933 [Cloud] Queued cloud request.
2026-07-31T22:27:30.933 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T22:27:30.933 [Cloud] Dequeued cloud request.
2026-07-31T22:27:30.933 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T22:27:31.089 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{22BFD116-78EC-DA8C-EA6D-CFBBBF123B4A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 22:27:31
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T22:27:31.589 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T22:27:37.433 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T22:36:42.809 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T22:36:42.809 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T22:36:42.809 [Cloud] Queued cloud request.
2026-07-31T22:36:42.809 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T22:36:42.809 [Cloud] Dequeued cloud request.
2026-07-31T22:36:42.809 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T22:36:42.980 [Cloud] End of cloud request.
2026-07-31T22:36:43.495 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T22:40:43.901 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T22:40:43.901 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T22:40:43.901 [Cloud] Queued cloud request.
2026-07-31T22:40:43.901 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T22:40:43.901 [Cloud] Dequeued cloud request.
2026-07-31T22:40:43.901 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T22:40:44.058 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F0160459-4DC2-B328-5B74-951BB04B4E6A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 22:40:44
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T22:40:44.573 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T22:42:42.433 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T22:55:00.057 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T22:55:00.057 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T22:55:00.057 [Cloud] Queued cloud request.
2026-07-31T22:55:00.057 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T22:55:00.057 [Cloud] Dequeued cloud request.
2026-07-31T22:55:00.057 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T22:55:00.261 [Cloud] End of cloud request.
2026-07-31T22:55:00.761 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T22:57:47.433 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T23:07:33.276 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T23:07:33.276 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T23:07:33.276 [Cloud] Queued cloud request.
2026-07-31T23:07:33.276 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T23:07:33.276 [Cloud] Dequeued cloud request.
2026-07-31T23:07:33.291 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T23:07:33.479 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{3113C988-19BD-1BF2-0A39-AE0DEFE166B4}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 23:07:33
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T23:07:33.995 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T23:10:23.182 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T23:10:23.198 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T23:10:23.198 [Cloud] Queued cloud request.
2026-07-31T23:10:23.198 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T23:10:23.198 [Cloud] Dequeued cloud request.
2026-07-31T23:10:23.198 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T23:10:23.370 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{412C7D0F-D5CF-6E4F-8521-3D6486ABACFF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 23:10:23
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T23:10:23.885 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T23:12:52.432 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T23:13:01.854 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T23:13:01.854 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T23:13:01.854 [Cloud] Queued cloud request.
2026-07-31T23:13:01.854 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T23:13:01.854 [Cloud] Dequeued cloud request.
2026-07-31T23:13:01.854 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T23:13:02.041 [Cloud] End of cloud request.
2026-07-31T23:13:02.541 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T23:16:03.229 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T23:16:03.229 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T23:16:03.229 [Cloud] Queued cloud request.
2026-07-31T23:16:03.229 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T23:16:03.229 [Cloud] Dequeued cloud request.
2026-07-31T23:16:03.229 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T23:16:03.666 [Cloud] End of cloud request.
2026-07-31T23:16:04.166 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T23:27:57.432 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T23:31:04.119 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T23:31:04.119 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T23:31:04.119 [Cloud] Queued cloud request.
2026-07-31T23:31:04.119 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T23:31:04.119 [Cloud] Dequeued cloud request.
2026-07-31T23:31:04.119 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T23:31:04.276 [Cloud] End of cloud request.
2026-07-31T23:31:04.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T23:41:12.619 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T23:41:12.619 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T23:41:12.619 [Cloud] Queued cloud request.
2026-07-31T23:41:12.619 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T23:41:12.635 [Cloud] Dequeued cloud request.
2026-07-31T23:41:12.635 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T23:41:12.822 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{5750F372-0308-5334-D6DC-B9BE3AB69B71}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 23:41:12
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T23:41:13.338 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T23:43:02.432 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-07-31T23:54:46.650 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-07-31T23:54:46.650 [Cloud] Start of cloud request. Passive mode: 0
2026-07-31T23:54:46.650 [Cloud] Queued cloud request.
2026-07-31T23:54:46.650 [Cloud] MpEngineCloudRequest(). hr = 0
2026-07-31T23:54:46.650 [Cloud] Dequeued cloud request.
2026-07-31T23:54:46.650 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-07-31T23:54:46.853 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{7E29D4AD-8D63-892E-AA8D-102FCB14F8AE}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:07-31-2026 23:54:46
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-07-31T23:54:47.353 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-07-31T23:58:07.431 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T00:00:01.259 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-7.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879801, FileId: 0x1c0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.259 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-7.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879800, FileId: 0x90000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.291 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879807, FileId: 0x1e0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.291 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879806, FileId: 0xb0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.291 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879813, FileId: 0x200000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.291 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879812, FileId: 0xd0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.306 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-10.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879819, FileId: 0x220000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.306 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-10.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879818, FileId: 0xf0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.322 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-13.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879825, FileId: 0x240000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.322 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-13.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879824, FileId: 0x110000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.322 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-16.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879831, FileId: 0x260000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.322 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-16.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879830, FileId: 0x130000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.338 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-19.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879836, FileId: 0x150000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.338 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-19.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879837, FileId: 0x280000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.353 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-1c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879843, FileId: 0x2a0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.353 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-1c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879842, FileId: 0x170000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.384 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-1f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879849, FileId: 0x190000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.384 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-1f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879850, FileId: 0x2c0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.400 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-22.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879856, FileId: 0x2e0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.400 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-22.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879855, FileId: 0x1b0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.416 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-25.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879861, FileId: 0x1d0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.416 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-25.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879862, FileId: 0x300000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.431 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-28.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879867, FileId: 0x1f0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.431 [RTP] [Mini-filter] Unsuccessful scan status(#27): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-28.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879868, FileId: 0x320000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.447 [RTP] [Mini-filter] Unsuccessful scan status(#29): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-2b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879873, FileId: 0x210000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.447 [RTP] [Mini-filter] Unsuccessful scan status(#28): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-2b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879874, FileId: 0x340000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.447 [RTP] [Mini-filter] Unsuccessful scan status(#30): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-2e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879879, FileId: 0x230000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.447 [RTP] [Mini-filter] Unsuccessful scan status(#31): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-2e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879880, FileId: 0x360000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.463 [RTP] [Mini-filter] Unsuccessful scan status(#33): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-31.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879886, FileId: 0x380000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.463 [RTP] [Mini-filter] Unsuccessful scan status(#32): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-31.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879885, FileId: 0x250000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.541 [RTP] [Mini-filter] Unsuccessful scan status(#35): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-35.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879963, FileId: 0x3a0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.541 [RTP] [Mini-filter] Unsuccessful scan status(#34): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-35.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879962, FileId: 0x270000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.556 [RTP] [Mini-filter] Unsuccessful scan status(#36): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-38.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879968, FileId: 0x290000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.556 [RTP] [Mini-filter] Unsuccessful scan status(#37): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-38.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879969, FileId: 0x3c0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.572 [RTP] [Mini-filter] Unsuccessful scan status(#38): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-3b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879975, FileId: 0x3e0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.572 [RTP] [Mini-filter] Unsuccessful scan status(#39): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-3b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879974, FileId: 0x2b0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.588 [RTP] [Mini-filter] Unsuccessful scan status(#41): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-3e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879981, FileId: 0x400000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.588 [RTP] [Mini-filter] Unsuccessful scan status(#40): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-3e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879980, FileId: 0x2d0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.603 [RTP] [Mini-filter] Unsuccessful scan status(#42): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-41.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879986, FileId: 0x2f0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.603 [RTP] [Mini-filter] Unsuccessful scan status(#43): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-41.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879987, FileId: 0x420000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.619 [RTP] [Mini-filter] Unsuccessful scan status(#44): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-44.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879992, FileId: 0x310000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.619 [RTP] [Mini-filter] Unsuccessful scan status(#45): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-44.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879993, FileId: 0x440000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.634 [RTP] [Mini-filter] Unsuccessful scan status(#46): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-47.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879998, FileId: 0x460000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.634 [RTP] [Mini-filter] Unsuccessful scan status(#47): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-47.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7879999, FileId: 0x330000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.650 [RTP] [Mini-filter] Unsuccessful scan status(#48): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-4a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880004, FileId: 0x350000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.650 [RTP] [Mini-filter] Unsuccessful scan status(#49): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-4a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880005, FileId: 0x480000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.666 [RTP] [Mini-filter] Unsuccessful scan status(#51): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-4d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880013, FileId: 0x4a0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.666 [RTP] [Mini-filter] Unsuccessful scan status(#50): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-4d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880012, FileId: 0x370000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.681 [RTP] [Mini-filter] Unsuccessful scan status(#52): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-50.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880018, FileId: 0x390000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.681 [RTP] [Mini-filter] Unsuccessful scan status(#53): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-50.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880019, FileId: 0x4c0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.697 [RTP] [Mini-filter] Unsuccessful scan status(#54): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-53.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880025, FileId: 0x4e0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.697 [RTP] [Mini-filter] Unsuccessful scan status(#55): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-53.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880024, FileId: 0x3b0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.713 [RTP] [Mini-filter] Unsuccessful scan status(#56): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-56.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880030, FileId: 0x3d0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.713 [RTP] [Mini-filter] Unsuccessful scan status(#57): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-56.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880031, FileId: 0x500000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.744 [RTP] [Mini-filter] Unsuccessful scan status(#58): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-59.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880037, FileId: 0x3f0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.744 [RTP] [Mini-filter] Unsuccessful scan status(#59): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-59.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880038, FileId: 0x520000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.759 [RTP] [Mini-filter] Unsuccessful scan status(#60): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-5c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880043, FileId: 0x410000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.759 [RTP] [Mini-filter] Unsuccessful scan status(#61): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-5c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880044, FileId: 0x540000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.775 [RTP] [Mini-filter] Unsuccessful scan status(#62): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-5f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880049, FileId: 0x430000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.775 [RTP] [Mini-filter] Unsuccessful scan status(#63): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-5f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880050, FileId: 0x560000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.791 [RTP] [Mini-filter] Unsuccessful scan status(#65): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-62.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880056, FileId: 0x580000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.791 [RTP] [Mini-filter] Unsuccessful scan status(#64): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-62.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880055, FileId: 0x450000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.806 [RTP] [Mini-filter] Unsuccessful scan status(#66): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-65.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880061, FileId: 0x470000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.806 [RTP] [Mini-filter] Unsuccessful scan status(#67): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-65.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880062, FileId: 0x5a0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.822 [RTP] [Mini-filter] Unsuccessful scan status(#69): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-68.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880068, FileId: 0x490000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.822 [RTP] [Mini-filter] Unsuccessful scan status(#68): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-68.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880067, FileId: 0x5c0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.838 [RTP] [Mini-filter] Unsuccessful scan status(#70): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-6b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880073, FileId: 0x4b0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.838 [RTP] [Mini-filter] Unsuccessful scan status(#71): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-6b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880074, FileId: 0x5e0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.838 [RTP] [Mini-filter] Unsuccessful scan status(#72): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-6e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880079, FileId: 0x4d0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.838 [RTP] [Mini-filter] Unsuccessful scan status(#73): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-6e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880080, FileId: 0x600000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.869 [RTP] [Mini-filter] Unsuccessful scan status(#74): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-72.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880105, FileId: 0x620000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.869 [RTP] [Mini-filter] Unsuccessful scan status(#75): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-72.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880104, FileId: 0x4f0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.884 [RTP] [Mini-filter] Unsuccessful scan status(#77): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-75.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880112, FileId: 0x640000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.884 [RTP] [Mini-filter] Unsuccessful scan status(#76): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-75.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880111, FileId: 0x510000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.900 [RTP] [Mini-filter] Unsuccessful scan status(#79): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-78.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880117, FileId: 0x530000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.900 [RTP] [Mini-filter] Unsuccessful scan status(#78): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-78.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880118, FileId: 0x660000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.916 [RTP] [Mini-filter] Unsuccessful scan status(#81): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-7b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880124, FileId: 0x680000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.916 [RTP] [Mini-filter] Unsuccessful scan status(#80): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-7b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880123, FileId: 0x550000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.931 [RTP] [Mini-filter] Unsuccessful scan status(#82): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-7e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880129, FileId: 0x570000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.931 [RTP] [Mini-filter] Unsuccessful scan status(#83): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-7e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880130, FileId: 0x6a0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.947 [RTP] [Mini-filter] Unsuccessful scan status(#85): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-81.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880135, FileId: 0x590000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.947 [RTP] [Mini-filter] Unsuccessful scan status(#84): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-81.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880136, FileId: 0x6c0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.963 [RTP] [Mini-filter] Unsuccessful scan status(#86): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-84.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880142, FileId: 0x6e0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.963 [RTP] [Mini-filter] Unsuccessful scan status(#87): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-84.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880141, FileId: 0x5b0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.978 [RTP] [Mini-filter] Unsuccessful scan status(#88): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-87.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880147, FileId: 0x5d0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.978 [RTP] [Mini-filter] Unsuccessful scan status(#89): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-87.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880148, FileId: 0x700000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.994 [RTP] [Mini-filter] Unsuccessful scan status(#90): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-8a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880153, FileId: 0x720000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:01.994 [RTP] [Mini-filter] Unsuccessful scan status(#91): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-8a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880154, FileId: 0x5f0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:02.072 [RTP] [Mini-filter] Unsuccessful scan status(#92): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-8e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880186, FileId: 0x610000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:02.072 [RTP] [Mini-filter] Unsuccessful scan status(#93): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-8e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880187, FileId: 0x740000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:02.088 [RTP] [Mini-filter] Unsuccessful scan status(#94): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-91.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880192, FileId: 0x630000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:02.088 [RTP] [Mini-filter] Unsuccessful scan status(#95): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-91.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880193, FileId: 0x760000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:02.103 [RTP] [Mini-filter] Unsuccessful scan status(#96): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-94.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880198, FileId: 0x650000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:02.103 [RTP] [Mini-filter] Unsuccessful scan status(#97): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-94.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880199, FileId: 0x780000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:02.119 [RTP] [Mini-filter] Unsuccessful scan status(#98): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-97.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880204, FileId: 0x670000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:02.119 [RTP] [Mini-filter] Unsuccessful scan status(#99): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-97.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880205, FileId: 0x7a0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:02.134 [RTP] [Mini-filter] Unsuccessful scan status(#100): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-9a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880210, FileId: 0x690000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:04.181 [RTP] [Mini-filter] Unsuccessful scan status(#110): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-aa.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880565, FileId: 0x860000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:04.244 [RTP] [Mini-filter] Unsuccessful scan status(#120): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-b9.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880594, FileId: 0x7d0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:04.306 [RTP] [Mini-filter] Unsuccessful scan status(#130): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-c8.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880624, FileId: 0x870000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:04.369 [RTP] [Mini-filter] Unsuccessful scan status(#140): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-d7.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880654, FileId: 0x910000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:04.431 [RTP] [Mini-filter] Unsuccessful scan status(#150): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-e6.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880685, FileId: 0x9b0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:04.478 [RTP] [Mini-filter] Unsuccessful scan status(#160): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-f5.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880717, FileId: 0xb80000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:04.556 [RTP] [Mini-filter] Unsuccessful scan status(#170): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-104.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880746, FileId: 0xaf0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:04.619 [RTP] [Mini-filter] Unsuccessful scan status(#180): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-113.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880776, FileId: 0xb90000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:04.681 [RTP] [Mini-filter] Unsuccessful scan status(#190): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-122.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880806, FileId: 0xc30000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:04.759 [RTP] [Mini-filter] Unsuccessful scan status(#200): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-131.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880840, FileId: 0xe00000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:04.822 [RTP] [Mini-filter] Unsuccessful scan status(#210): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-140.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880869, FileId: 0xd70000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:04.902 [RTP] [Mini-filter] Unsuccessful scan status(#220): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-14f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880899, FileId: 0x120000000c4815, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:04.963 [RTP] [Mini-filter] Unsuccessful scan status(#230): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-15e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880930, FileId: 0x1c0000000c4815, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:05.072 [RTP] [Mini-filter] Unsuccessful scan status(#240): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-16d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880960, FileId: 0x1080000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:05.134 [RTP] [Mini-filter] Unsuccessful scan status(#250): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-17c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7880991, FileId: 0x1120000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:05.197 [RTP] [Mini-filter] Unsuccessful scan status(#260): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-18b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881021, FileId: 0x11c0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:05.259 [RTP] [Mini-filter] Unsuccessful scan status(#270): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-19a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881051, FileId: 0x1260000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:05.338 [RTP] [Mini-filter] Unsuccessful scan status(#280): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-1a9.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881082, FileId: 0x1300000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:05.400 [RTP] [Mini-filter] Unsuccessful scan status(#290): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-1b8.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881113, FileId: 0x13a0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:05.463 [RTP] [Mini-filter] Unsuccessful scan status(#300): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-1c7.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881143, FileId: 0x620000000c4815, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:05.525 [RTP] [Mini-filter] Unsuccessful scan status(#310): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-1d6.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881174, FileId: 0x14e0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:05.697 [RTP] [Mini-filter] Unsuccessful scan status(#320): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-1e6.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881335, FileId: 0x1580000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:05.806 [RTP] [Mini-filter] Unsuccessful scan status(#330): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-1f8.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881373, FileId: 0x1620000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:05.884 [RTP] [Mini-filter] Unsuccessful scan status(#340): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-207.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881403, FileId: 0xec0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:05.978 [RTP] [Mini-filter] Unsuccessful scan status(#350): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-216.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881435, FileId: 0x1760000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:06.072 [RTP] [Mini-filter] Unsuccessful scan status(#360): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-225.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881464, FileId: 0x1000000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:06.150 [RTP] [Mini-filter] Unsuccessful scan status(#370): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-234.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881495, FileId: 0x10a0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:06.213 [RTP] [Mini-filter] Unsuccessful scan status(#380): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-243.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881525, FileId: 0x1140000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:06.369 [RTP] [Mini-filter] Unsuccessful scan status(#390): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-253.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881686, FileId: 0x11e0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:06.431 [RTP] [Mini-filter] Unsuccessful scan status(#400): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-262.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881716, FileId: 0x1a80000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:06.509 [RTP] [Mini-filter] Unsuccessful scan status(#410): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-271.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881747, FileId: 0x1320000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:06.572 [RTP] [Mini-filter] Unsuccessful scan status(#420): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-280.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881778, FileId: 0x1bc0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:06.634 [RTP] [Mini-filter] Unsuccessful scan status(#430): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-28f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881807, FileId: 0x1460000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:06.713 [RTP] [Mini-filter] Unsuccessful scan status(#440): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-29e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881838, FileId: 0x1d00000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:06.791 [RTP] [Mini-filter] Unsuccessful scan status(#450): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-2ad.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7881870, FileId: 0x15a0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:06.994 [RTP] [Mini-filter] Unsuccessful scan status(#460): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-2bd.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882076, FileId: 0x1e40000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:07.088 [RTP] [Mini-filter] Unsuccessful scan status(#470): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-2cc.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882105, FileId: 0x16e0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:07.197 [RTP] [Mini-filter] Unsuccessful scan status(#480): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-2db.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882135, FileId: 0x1780000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:07.275 [RTP] [Mini-filter] Unsuccessful scan status(#490): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-2ea.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882166, FileId: 0x1820000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:07.353 [RTP] [Mini-filter] Unsuccessful scan status(#500): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-2f9.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882195, FileId: 0x18c0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:07.416 [RTP] [Mini-filter] Unsuccessful scan status(#510): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-308.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882226, FileId: 0x2160000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:07.494 [RTP] [Mini-filter] Unsuccessful scan status(#520): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-317.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882256, FileId: 0x1a00000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:07.572 [RTP] [Mini-filter] Unsuccessful scan status(#530): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-326.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882286, FileId: 0x22a0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:07.681 [RTP] [Mini-filter] Unsuccessful scan status(#540): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-338.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882323, FileId: 0x1b60000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:07.791 [RTP] [Mini-filter] Unsuccessful scan status(#550): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-348.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882435, FileId: 0x900000000c4815, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:07.869 [RTP] [Mini-filter] Unsuccessful scan status(#560): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-357.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882465, FileId: 0x9a0000000c4815, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:07.931 [RTP] [Mini-filter] Unsuccessful scan status(#570): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-366.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882496, FileId: 0x1d40000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:08.009 [RTP] [Mini-filter] Unsuccessful scan status(#580): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-375.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882527, FileId: 0x1de0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:08.197 [RTP] [Mini-filter] Unsuccessful scan status(#590): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-385.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882690, FileId: 0xb80000000c4815, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:08.259 [RTP] [Mini-filter] Unsuccessful scan status(#600): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-394.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882720, FileId: 0xc20000000c4815, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:08.338 [RTP] [Mini-filter] Unsuccessful scan status(#610): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-3a3.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882751, FileId: 0x1fc0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:08.400 [RTP] [Mini-filter] Unsuccessful scan status(#620): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-3b2.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882780, FileId: 0xd60000000c4815, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:08.463 [RTP] [Mini-filter] Unsuccessful scan status(#630): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-3c1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882810, FileId: 0x2100000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:08.556 [RTP] [Mini-filter] Unsuccessful scan status(#640): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-3d0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882841, FileId: 0x21a0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:08.619 [RTP] [Mini-filter] Unsuccessful scan status(#650): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-3df.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882872, FileId: 0x2380000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:08.697 [RTP] [Mini-filter] Unsuccessful scan status(#660): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-3ee.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882905, FileId: 0x2420000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:09.103 [RTP] [Mini-filter] Unsuccessful scan status(#670): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-3fc.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7882994, FileId: 0xfe0000000c4815, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:09.166 [RTP] [Mini-filter] Unsuccessful scan status(#680): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-40b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883024, FileId: 0x2540000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:09.259 [RTP] [Mini-filter] Unsuccessful scan status(#690): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-41a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883053, FileId: 0x1120000000c4815, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:09.338 [RTP] [Mini-filter] Unsuccessful scan status(#700): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-429.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883085, FileId: 0x2680000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:09.400 [RTP] [Mini-filter] Unsuccessful scan status(#710): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-438.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883115, FileId: 0x1260000000c4815, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:09.525 [RTP] [Mini-filter] Unsuccessful scan status(#720): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-44c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883159, FileId: 0x27d0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:09.588 [RTP] [Mini-filter] Unsuccessful scan status(#730): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-45b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883190, FileId: 0x2870000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:09.650 [RTP] [Mini-filter] Unsuccessful scan status(#740): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-46a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883220, FileId: 0x280000000c4817, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:09.744 [RTP] [Mini-filter] Unsuccessful scan status(#750): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-47a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883274, FileId: 0x320000000c4817, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:09.822 [RTP] [Mini-filter] Unsuccessful scan status(#760): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-48a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883331, FileId: 0x3c0000000c4817, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:09.916 [RTP] [Mini-filter] Unsuccessful scan status(#770): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-49a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883385, FileId: 0x2210000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:09.994 [RTP] [Mini-filter] Unsuccessful scan status(#780): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-4aa.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883439, FileId: 0x22b0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:10.103 [RTP] [Mini-filter] Unsuccessful scan status(#790): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-4b9.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883470, FileId: 0x2c30000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:10.181 [RTP] [Mini-filter] Unsuccessful scan status(#800): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-4c9.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883529, FileId: 0x23f0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:10.291 [RTP] [Mini-filter] Unsuccessful scan status(#810): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-4d9.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883606, FileId: 0x2d70000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:10.353 [RTP] [Mini-filter] Unsuccessful scan status(#820): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-4e8.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883636, FileId: 0x2530000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:10.463 [RTP] [Mini-filter] Unsuccessful scan status(#830): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-4f8.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883715, FileId: 0x2eb0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:10.525 [RTP] [Mini-filter] Unsuccessful scan status(#840): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-507.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883745, FileId: 0x2f50000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:10.588 [RTP] [Mini-filter] Unsuccessful scan status(#850): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-516.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883776, FileId: 0x2710000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:10.697 [RTP] [Mini-filter] Unsuccessful scan status(#860): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-526.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883854, FileId: 0x27b0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:10.775 [RTP] [Mini-filter] Unsuccessful scan status(#870): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-535.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883886, FileId: 0x2850000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:10.884 [RTP] [Mini-filter] Unsuccessful scan status(#880): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-545.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883965, FileId: 0x28f0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:10.947 [RTP] [Mini-filter] Unsuccessful scan status(#890): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-554.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7883996, FileId: 0x2990000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:11.056 [RTP] [Mini-filter] Unsuccessful scan status(#900): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-563.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7884025, FileId: 0x2a30000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:11.181 [RTP] [Mini-filter] Unsuccessful scan status(#910): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-573.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7884105, FileId: 0x2ad0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:11.291 [RTP] [Mini-filter] Unsuccessful scan status(#920): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-582.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7884135, FileId: 0x2b70000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:11.400 [RTP] [Mini-filter] Unsuccessful scan status(#930): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-592.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7884213, FileId: 0x2c10000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:11.463 [RTP] [Mini-filter] Unsuccessful scan status(#940): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-5a1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7884243, FileId: 0x3590000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:11.572 [RTP] [Mini-filter] Unsuccessful scan status(#950): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-5b1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7884323, FileId: 0x3630000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:11.650 [RTP] [Mini-filter] Unsuccessful scan status(#960): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-5c0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7884352, FileId: 0x36d0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:11.728 [RTP] [Mini-filter] Unsuccessful scan status(#970): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-5cf.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7884382, FileId: 0x3770000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:11.822 [RTP] [Mini-filter] Unsuccessful scan status(#980): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-5df.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7884463, FileId: 0x2f30000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:11.884 [RTP] [Mini-filter] Unsuccessful scan status(#990): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-5ee.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7884493, FileId: 0x38b0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:11.994 [RTP] [Mini-filter] Unsuccessful scan status(#1000): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-5fe.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7884571, FileId: 0x3070000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:12.884 [RTP] [Mini-filter] Unsuccessful scan status(#1100): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-698.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7885061, FileId: 0x3f90000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:13.902 [RTP] [Mini-filter] Unsuccessful scan status(#1200): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-735.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7885567, FileId: 0x1510000000c4815, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:15.228 [RTP] [Mini-filter] Unsuccessful scan status(#1300): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-7ce.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7885984, FileId: 0x4910000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:16.088 [RTP] [Mini-filter] Unsuccessful scan status(#1400): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d5-871.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7886351, FileId: 0x4d0000000c4817, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:17.900 [RTP] [Mini-filter] Unsuccessful scan status(#1500): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24d6-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7886793, FileId: 0x4eb0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:18.978 [RTP] [Mini-filter] Unsuccessful scan status(#1600): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24da-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7887118, FileId: 0x5570000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:19.728 [RTP] [Mini-filter] Unsuccessful scan status(#1700): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24da-ba.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7887422, FileId: 0x54b0000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:20.525 [RTP] [Mini-filter] Unsuccessful scan status(#1800): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24db-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7887735, FileId: 0x6210000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:21.384 [RTP] [Mini-filter] Unsuccessful scan status(#1900): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24dc-48.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7888054, FileId: 0x6890000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:22.181 [RTP] [Mini-filter] Unsuccessful scan status(#2000): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24dd-75.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7888364, FileId: 0x6ef0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:23.103 [RTP] [Mini-filter] Unsuccessful scan status(#2100): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24df-3c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7888685, FileId: 0x30e0000000c4815, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:23.900 [RTP] [Mini-filter] Unsuccessful scan status(#2200): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24e0-66.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7888996, FileId: 0x6190000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:25.228 [RTP] [Mini-filter] Unsuccessful scan status(#2300): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24e7-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7889345, FileId: 0x6890000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:26.197 [RTP] [Mini-filter] Unsuccessful scan status(#2400): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24eb-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7889671, FileId: 0x8970000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:27.134 [RTP] [Mini-filter] Unsuccessful scan status(#2500): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24ef-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7889997, FileId: 0x7610000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:28.228 [RTP] [Mini-filter] Unsuccessful scan status(#2600): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24f3-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7890326, FileId: 0x96f0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:29.228 [RTP] [Mini-filter] Unsuccessful scan status(#2700): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24f7-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7890651, FileId: 0x9db0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:30.259 [RTP] [Mini-filter] Unsuccessful scan status(#2800): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24fb-39.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7890979, FileId: 0x8a50000000c4814, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:31.775 [RTP] [Mini-filter] Unsuccessful scan status(#2900): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24fd-14c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7892048, FileId: 0xab20000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:32.666 [RTP] [Mini-filter] Unsuccessful scan status(#3000): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24fd-27e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7892809, FileId: 0xb170000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:33.447 [RTP] [Mini-filter] Unsuccessful scan status(#3100): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24fd-350.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7893729, FileId: 0xb570000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:33.947 [RTP] [Mini-filter] Unsuccessful scan status(#3200): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24fd-3d4.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7894253, FileId: 0xb8b0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:00:34.963 [RTP] [Mini-filter] Unsuccessful scan status(#3300): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2501-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7894614, FileId: 0xbee0000000c4811, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T00:10:46.338 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T00:10:46.338 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T00:10:46.338 [Cloud] Queued cloud request.
2026-08-01T00:10:46.338 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T00:10:46.338 [Cloud] Dequeued cloud request.
2026-08-01T00:10:46.338 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T00:10:46.494 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{0233B05E-D218-57D0-2A8E-14B232E49B04}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 00:10:46
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T00:10:46.994 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T00:12:05.181 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T00:12:05.181 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T00:12:05.181 [Cloud] Queued cloud request.
2026-08-01T00:12:05.181 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T00:12:05.181 [Cloud] Dequeued cloud request.
2026-08-01T00:12:05.181 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T00:12:05.338 [Cloud] End of cloud request.
2026-08-01T00:12:05.838 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T00:13:12.431 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T00:15:31.478 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T00:15:31.478 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T00:15:31.478 [Cloud] Queued cloud request.
2026-08-01T00:15:31.478 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T00:15:31.478 [Cloud] Dequeued cloud request.
2026-08-01T00:15:31.478 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T00:15:31.619 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{B6EF100E-E37B-5DBF-555F-FAB43F837286}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 00:15:31
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T00:15:32.134 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T00:19:21.103 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T00:19:21.103 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T00:19:21.103 [Cloud] Queued cloud request.
2026-08-01T00:19:21.103 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T00:19:21.103 [Cloud] Dequeued cloud request.
2026-08-01T00:19:21.103 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T00:19:21.259 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{99110B6B-A239-0792-582D-9E794C266DD6}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 00:19:21
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T00:19:21.759 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T00:23:26.978 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 18894, Count: 706, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-01T00:23:26.978 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 7415, Count: 384, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\googlemaps\Wienerberg_20060501.html, EstimatedImpact: 0%
2026-08-01T00:23:26.978 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 5984, Count: 233, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-08-01T00:23:26.978 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 4591, Count: 7087, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24a6-0.MAI, EstimatedImpact: 0%
2026-08-01T00:23:26.978 ProcessImageName: powershell.exe, Pid: 6020, TotalTime: 2069, Count: 106, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 39%
2026-08-01T00:23:26.978 ProcessImageName: AgentShellService.exe, Pid: 1376, TotalTime: 1073, Count: 20, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 61%
2026-08-01T00:23:26.978 ProcessImageName: WmiPrvSE.exe, Pid: 5216, TotalTime: 1001, Count: 26, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 7%
2026-08-01T00:23:26.978 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 550, Count: 26, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0%
2026-08-01T00:23:26.978 ProcessImageName: WmiPrvSE.exe, Pid: 8536, TotalTime: 372, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\win32kbase.sys, EstimatedImpact: 0%
2026-08-01T00:23:26.978 ProcessImageName: ngentask.exe, Pid: 5544, TotalTime: 228, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 41%
2026-08-01T00:23:26.978 ProcessImageName: ngentask.exe, Pid: 1124, TotalTime: 150, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-08-01T00:23:26.978 ProcessImageName: ngentask.exe, Pid: 1328, TotalTime: 135, Count: 15, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19%
2026-08-01T00:23:26.978 ProcessImageName: ngentask.exe, Pid: 7164, TotalTime: 121, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 20%
2026-08-01T00:23:26.978 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 121, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-08-01T00:23:26.978 ProcessImageName: taskhostw.exe, Pid: 5416, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 17%
2026-08-01T00:23:26.978 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemResources\shsvcs.dll.mun, EstimatedImpact: 0%
2026-08-01T00:23:26.978 ProcessImageName: powershell.exe, Pid: 1856, TotalTime: 91, Count: 6, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp8EF5.tmp, EstimatedImpact: 0%
2026-08-01T00:23:26.978 ProcessImageName: powershell.exe, Pid: 7320, TotalTime: 77, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp7EA9.tmp, EstimatedImpact: 0%
2026-08-01T00:23:26.978 ProcessImageName: taskhostw.exe, Pid: 8644, TotalTime: 76, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SYSTEM, EstimatedImpact: 1%
2026-08-01T00:23:26.978 ProcessImageName: cmd.exe, Pid: 5632, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\dumpalldatabases.bat, EstimatedImpact: 0%
2026-08-01T00:23:26.978 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-01T00:23:26.978 ProcessImageName: mysqldump.exe, Pid: 7340, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 0%
2026-08-01T00:28:17.431 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T00:43:22.431 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T00:46:44.821 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:DA100663-5E57-49AD-B367-66C9C59A6BE9, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1)
2026-08-01T00:46:44.821 Scheduled scan with Id DA100663-5E57-49AD-B367-66C9C59A6BE9 configured CPU priority: normal (LowCpuPriority: 0)
2026-08-01T00:46:44.837 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build.
2026-08-01T00:46:44.837 [SFC] System file cache build is not needed (already completed)
2026-08-01T00:47:04.009 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T00:47:04.009 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T00:47:04.009 [Cloud] Queued cloud request.
2026-08-01T00:47:04.009 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T00:47:04.009 [Cloud] Dequeued cloud request.
2026-08-01T00:47:04.009 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T00:47:04.165 [Cloud] End of cloud request.
2026-08-01T00:47:04.681 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T00:47:13.899 Engine:Triggered AR EMS scan

2026-08-01T00:47:13.899 Engine:EMS scan for process: lsass pid: 628, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:13.915 Engine:EMS scan for process: svchost pid: 744, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:13.931 Engine:EMS scan for process: svchost pid: 848, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:13.931 Engine:EMS scan for process: svchost pid: 916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:13.946 Engine:EMS scan for process: svchost pid: 988, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:13.962 Engine:EMS scan for process: svchost pid: 1008, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:13.962 Engine:EMS scan for process: svchost pid: 472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:13.978 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:13.993 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:13.993 Engine:EMS scan for process: svchost pid: 1104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:13.993 Engine:EMS scan for process: svchost pid: 1264, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:13.993 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:13.993 Engine:EMS scan for process: svchost pid: 1360, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.009 Engine:EMS scan for process: svchost pid: 1380, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.009 Engine:EMS scan for process: svchost pid: 1388, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.024 Engine:EMS scan for process: svchost pid: 1432, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.040 Engine:EMS scan for process: svchost pid: 1440, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.040 Engine:EMS scan for process: svchost pid: 1464, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.040 Engine:EMS scan for process: svchost pid: 1504, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.056 Engine:EMS scan for process: svchost pid: 1756, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.056 Engine:EMS scan for process: svchost pid: 1808, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.071 Engine:EMS scan for process: svchost pid: 1820, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.087 Engine:EMS scan for process: svchost pid: 1836, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.087 Engine:EMS scan for process: svchost pid: 1892, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.087 Engine:EMS scan for process: svchost pid: 1956, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.087 Engine:EMS scan for process: svchost pid: 2020, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.103 Engine:EMS scan for process: svchost pid: 2028, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.103 Engine:EMS scan for process: svchost pid: 1460, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.118 Engine:EMS scan for process: svchost pid: 1532, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.118 Engine:EMS scan for process: svchost pid: 2120, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.134 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.134 Engine:EMS scan for process: svchost pid: 2384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.134 Engine:EMS scan for process: svchost pid: 2496, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.149 Engine:EMS scan for process: svchost pid: 2512, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.149 Engine:EMS scan for process: svchost pid: 2532, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.165 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.165 Engine:EMS scan for process: svchost pid: 2560, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.165 Engine:EMS scan for process: svchost pid: 2620, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.181 Engine:EMS scan for process: svchost pid: 2632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.181 Engine:EMS scan for process: svchost pid: 2936, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.196 Engine:EMS scan for process: svchost pid: 3016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.196 Engine:EMS scan for process: svchost pid: 3056, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.196 Engine:EMS scan for process: svchost pid: 3128, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.212 Engine:EMS scan for process: svchost pid: 3176, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.212 Engine:EMS scan for process: svchost pid: 3236, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.228 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.228 Engine:EMS scan for process: svchost pid: 3364, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.228 Engine:EMS scan for process: svchost pid: 3184, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.243 Engine:EMS scan for process: dllhost pid: 4116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.243 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.259 Engine:EMS scan for process: svchost pid: 3432, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.274 Engine:EMS scan for process: svchost pid: 4860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.290 Engine:EMS scan for process: svchost pid: 1772, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.290 Engine:EMS scan for process: svchost pid: 1112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.306 Engine:EMS scan for process: svchost pid: 1496, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.306 Engine:EMS scan for process: svchost pid: 5320, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.321 Engine:EMS scan for process: svchost pid: 2444, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.337 Engine:EMS scan for process: svchost pid: 3068, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.353 Engine:EMS scan for process: svchost pid: 7360, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-01T00:47:14.368 Engine:EMS scan for process: svchost pid: 5256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
2026-08-01T00:48:02.556 QuickScan:ScanID:DA100663-5E57-49AD-B367-66C9C59A6BE9: Quick scan finished with error 0
2026-08-01T00:48:02.587 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T00:48:02.587 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T00:48:02.587 [Cloud] Queued cloud request.
2026-08-01T00:48:02.587 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T00:48:02.587 [Cloud] Dequeued cloud request.
2026-08-01T00:48:02.587 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T00:48:02.603 [Cloud] End of cloud request.
2026-08-01T00:48:02.603 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xe6d2f6467ffffffe
2026-08-01T00:48:02.603 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xa719dd6a7ffffffe
2026-08-01T00:48:02.618 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xe6d2f6467ffffffe
2026-08-01T00:48:02.618 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xa719dd6a7ffffffe
2026-08-01T00:48:02.634 UnknownTelemetryScan triggered, type: 2 (1 - Unknown, 2- Lofi), flags: 0 (0 - Regular, 1 - MemScan), 2 resources, RtpIoavOnly: FALSE
2026-08-01T00:48:03.103 [RTP] [RtpConfig] Config change detected, type: 32
2026-08-01T00:48:03.103 [RTP] Duplicating the current plugin configuration object...
2026-08-01T00:48:03.103 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ...
2026-08-01T00:48:03.103 [RTP] Updating plugin configuration due to recent config changes (0x20) ...
2026-08-01T00:48:03.103 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-01T00:48:03.103 [RTP] No config change detected. Not updating plugin configuration.
2026-08-01T00:48:03.103 [RTP] No config changes found. No configuration switch.
2026-08-01T00:48:03.103 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0
2026-08-01T00:48:03.103 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
2026-08-01T00:48:08.402 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xe6d2f6467ffffffe
2026-08-01T00:48:08.402 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xa719dd6a7ffffffe
2026-08-01T00:48:08.415 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xe6d2f6467ffffffe
2026-08-01T00:48:08.415 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xa719dd6a7ffffffe
2026-08-01T00:48:08.446 [Cloud] SubmitReport(CMpUnknownSpyNetReportContext)
2026-08-01T00:48:08.446 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T00:48:08.446 [Cloud] Queued cloud request.
2026-08-01T00:48:08.462 [Cloud] Dequeued cloud request.
2026-08-01T00:48:08.478 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T00:48:08.493 [Cloud] MpEngineParseSpyNetResponse(). hr = 0
2026-08-01T00:48:08.493 [Cloud] End of cloud request.
2026-08-01T00:48:08.993 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T00:58:27.430 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T01:13:32.430 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T01:22:49.493 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T01:22:49.493 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T01:22:49.493 [Cloud] Queued cloud request.
2026-08-01T01:22:49.493 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T01:22:49.493 [Cloud] Dequeued cloud request.
2026-08-01T01:22:49.493 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T01:22:49.680 [Cloud] End of cloud request.
2026-08-01T01:22:50.196 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T01:23:01.243 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T01:23:01.243 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T01:23:01.243 [Cloud] Queued cloud request.
2026-08-01T01:23:01.243 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T01:23:01.243 [Cloud] Dequeued cloud request.
2026-08-01T01:23:01.243 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T01:23:01.321 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{40942D57-DA53-EC9A-DA55-FBD93738DA84}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 01:23:01
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T01:23:01.837 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T01:24:55.852 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T01:24:55.852 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T01:24:55.852 [Cloud] Queued cloud request.
2026-08-01T01:24:55.852 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T01:24:55.852 [Cloud] Dequeued cloud request.
2026-08-01T01:24:55.852 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T01:24:56.055 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{742DDAB2-4E1C-9DFB-C608-8D2A3865A478}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 01:24:56
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T01:24:56.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T01:25:10.977 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T01:25:10.977 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T01:25:10.977 [Cloud] Queued cloud request.
2026-08-01T01:25:10.977 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T01:25:10.977 [Cloud] Dequeued cloud request.
2026-08-01T01:25:10.977 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T01:25:11.055 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{702B6296-86B0-FDBF-FB80-0851A2739DDF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 01:25:11
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T01:25:11.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T01:28:37.430 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T01:34:03.211 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T01:34:03.211 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T01:34:03.211 [Cloud] Queued cloud request.
2026-08-01T01:34:03.211 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T01:34:03.211 [Cloud] Dequeued cloud request.
2026-08-01T01:34:03.211 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T01:34:03.399 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{11747A47-DB46-FC42-3BBE-6065E0268D71}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 01:34:03
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T01:34:03.914 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T01:34:26.071 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T01:34:26.071 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T01:34:26.071 [Cloud] Queued cloud request.
2026-08-01T01:34:26.071 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T01:34:26.071 [Cloud] Dequeued cloud request.
2026-08-01T01:34:26.086 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T01:34:26.196 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{EFFF97DC-AE0A-DD89-CB65-33BE15A82C99}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 01:34:26
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T01:34:26.696 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T01:43:42.430 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T01:58:47.430 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T02:06:29.195 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T02:06:29.195 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T02:06:29.195 [Cloud] Queued cloud request.
2026-08-01T02:06:29.195 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T02:06:29.195 [Cloud] Dequeued cloud request.
2026-08-01T02:06:29.195 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T02:06:29.351 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E3685D97-FEAB-59EB-CFA2-13C2B6C4481F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 02:06:29
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T02:06:29.867 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T02:12:25.742 [AutoPurge] Verification Routine tasks have started.
2026-08-01T02:12:25.742 [AutoPurge] Routine task for Cache Maintenance has started.
2026-08-01T02:12:25.742 [AutoPurge] Routine task for Cache Maintenance ...
2026-08-01T02:12:25.742 [AutoPurge] Routine task for MpSFCBuild ...
2026-08-01T02:12:25.742 [AutoPurge] MpCmIsBuildCompleted() - S_OK
2026-08-01T02:12:25.742 [AutoPurge] MpSignalMaintenanceMode ...ApplyDefenderProcessTokenTrustLableAce succeeded to set.
2026-08-01T02:12:25.882 EnsureProtectedFolderAcls(), hr = 0x0
2026-08-01T02:12:25.903 [AutoPurge] MpReinforceServiceAcls: 0
2026-08-01T02:12:25.929 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0
2026-08-01T02:12:26.273 [AutoPurge] Cleanup Routine tasks have started.
2026-08-01T02:12:26.320 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0)
2026-08-01T02:12:26.320 [AutoPurge] Purged 0 expired detection item(s) from a total of 0.
2026-08-01T02:12:26.320 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds)
Beginning quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Target:
Flags:65538
Start time:08-01-2026 02:12:26
Finished quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Result:0
End time:08-01-2026 02:12:26
2026-08-01T02:12:26.320 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ...
2026-08-01T02:12:26.320 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26060.3008-0 ...
2026-08-01T02:12:26.320 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26050.15-0 ...
2026-08-01T02:12:26.320 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26040.7-0 ...
2026-08-01T02:12:26.320 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ...
2026-08-01T02:12:26.320 [AutoPurge] Cleanup Routine tasks have ended.
2026-08-01T02:12:26.351 Job Notification: New process added to job (6124)
2026-08-01T02:12:26.351 Task(GetDeviceTicket -AccessKey E57B7F64-DA50-505A-C3F4-C12D65B28828 ) launched as network service
2026-08-01T02:12:26.867 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\system32\mtf.dll", hr=0x0
2026-08-01T02:12:26.992 Engine:Setting original file name "comdlg32.dll" for "c:\windows\systemresources\comdlg32.dll.mun", hr=0x0
2026-08-01T02:12:27.039 Job Notification: Process exited from job (6124)
2026-08-01T02:12:27.117 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0
2026-08-01T02:12:27.211 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T02:12:27.211 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T02:12:27.211 [Cloud] Queued cloud request.
2026-08-01T02:12:27.211 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T02:12:27.211 [Cloud] Dequeued cloud request.
2026-08-01T02:12:27.211 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0
2026-08-01T02:12:27.211 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T02:12:27.211 [Cloud] Queued cloud request.
2026-08-01T02:12:27.211 [AutoPurge] Removing expired default signature package ...
2026-08-01T02:12:27.226 [Cloud] Dequeued cloud request.
2026-08-01T02:12:27.226 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T02:12:27.226 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T02:12:27.351 [Cloud] End of cloud request.
2026-08-01T02:12:27.429 [Cloud] MpEngineParseSpyNetResponse(). hr = 0
2026-08-01T02:12:27.429 [Cloud] End of cloud request.
2026-08-01T02:12:27.507 Job Notification: New process added to job (5800)
2026-08-01T02:12:27.742 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ...
2026-08-01T02:12:27.757 [RTP] [RtpConfig] Config change detected, type: 32
2026-08-01T02:12:27.757 [RTP] [RtpConfig] Config change detected, type: 2
2026-08-01T02:12:27.757 [RTP] [RtpConfig] Config change detected, type: 4096
2026-08-01T02:12:27.757 [RTP] [RtpConfig] Config change detected, type: 4
2026-08-01T02:12:27.757 [RTP] [RtpConfig] Config change detected, type: 8
2026-08-01T02:12:27.757 [RTP] [RtpConfig] Config change detected, type: 16
2026-08-01T02:12:27.757 [RTP] [RtpConfig] Config change detected, type: 1024
2026-08-01T02:12:27.757 [RTP] [RtpConfig] Config change detected, type: 2048
2026-08-01T02:12:27.757 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0).
2026-08-01T02:12:27.757 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0).
2026-08-01T02:12:27.757 [RTP] Setting FilterExperimentMode to 0 (hr=0).
2026-08-01T02:12:27.757 [RTP] Setting DisableDriverUnload to 1 (hr=0).
2026-08-01T02:12:27.757 [RTP] Setting RegLinkHardeningMode to 1 (hr=0).
2026-08-01T02:12:27.757 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0).
2026-08-01T02:12:27.757 [RTP] Setting EfsHardeningFlags to 0 (hr=0).
2026-08-01T02:12:27.757 [RTP] PreventPagingFileAbuseKillbit[0].
2026-08-01T02:12:27.757 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0).
2026-08-01T02:12:27.757 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0).
2026-08-01T02:12:27.757 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration.
2026-08-01T02:12:27.757 [RTP] [RtpConfig] Config change detected, type: 64
2026-08-01T02:12:27.773 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T02:12:27.773 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T02:12:27.773 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T02:12:27.773 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T02:12:27.773 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T02:12:28.039 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0
2026-08-01T02:12:28.336 Engine:Setting original file name "WerMgr" for "c:\windows\system32\wermgr.exe", hr=0x0
2026-08-01T02:12:28.429 Job Notification: Process exited from job (5800)
2026-08-01T02:12:28.461 [AutoPurge] Verification Routine tasks have ended.
2026-08-01T02:12:28.461 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0
2026-08-01T02:12:28.570 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpmodemx.dll", hr=0x0
2026-08-01T02:12:28.633 Engine:Setting original file name "msdt.exe" for "c:\windows\systemresources\msdt.exe.mun", hr=0x0
2026-08-01T02:12:29.054 Engine:Setting original file name "FIREWALLCONTROLPANEL.DLL" for "c:\windows\systemresources\firewallcontrolpanel.dll.mun", hr=0x0
2026-08-01T02:12:30.086 Engine:Setting original file name "Winlangdb.dll" for "c:\windows\winsxs\amd64_microsoft-windows-languagesdb-onecore_31bf3856ad364e35_10.0.20348.3451_none_13b6dc898b15fcbe\winlangdb.dll.mun", hr=0x0
2026-08-01T02:12:30.336 [RTP] Duplicating the current plugin configuration object...
2026-08-01T02:12:30.336 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ...
2026-08-01T02:12:30.336 [RTP] Updating plugin configuration due to recent config changes (0x43e) ...
2026-08-01T02:12:30.336 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-01T02:12:30.336 [RTP] Calling GenerateEngineConfigStruct (0x18) ...
2026-08-01T02:12:30.336 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218
2026-08-01T02:12:31.429 Engine:Setting original file name "d2d1" for "c:\windows\syswow64\d2d1.dll", hr=0x0
2026-08-01T02:12:32.070 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0
2026-08-01T02:12:32.211 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0
2026-08-01T02:12:32.898 Engine:Setting original file name "d2d1" for "c:\windows\system32\d2d1.dll", hr=0x0
2026-08-01T02:12:33.414 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\system32\mpg4decd.dll", hr=0x0
2026-08-01T02:12:33.414 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0
2026-08-01T02:12:34.179 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0
2026-08-01T02:12:34.836 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0
2026-08-01T02:12:35.086 Engine:Setting original file name "msdxm.ocx" for "c:\windows\syswow64\dxmasf.dll", hr=0x0
2026-08-01T02:12:35.664 Engine:Setting original file name "VCOMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcomp140_app.dll", hr=0x0
2026-08-01T02:12:37.320 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\syswow64\acgenral.dll", hr=0x0
2026-08-01T02:12:37.867 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\system32\servicingcommon.dll", hr=0x0
2026-08-01T02:12:38.633 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\system32\licensingwinrt.dll", hr=0x0
2026-08-01T02:12:39.726 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnsvr.exe", hr=0x0
2026-08-01T02:12:40.633 Engine:Setting original file name "ntkrnlmp.exe" for "c:\windows\winsxs\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.20348.5386_none_14ac9716e654f424\ntoskrnl.exe", hr=0x0
2026-08-01T02:12:42.054 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0
2026-08-01T02:12:42.086 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnlobby.dll", hr=0x0
2026-08-01T02:12:42.179 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0
2026-08-01T02:12:42.195 Engine:Setting original file name "gdi32" for "c:\windows\system32\gdi32full.dll", hr=0x0
2026-08-01T02:12:42.414 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\system32\winresume.exe", hr=0x0
2026-08-01T02:12:42.648 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0
2026-08-01T02:12:42.758 Engine:Setting original file name "setup" for "c:\programdata\package cache\{1de5e707-82da-4db6-b810-5d140cc4cbb3}\vc_redist.x64.exe", hr=0x0
2026-08-01T02:12:42.883 Engine:Setting original file name "mini_installer.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{56eb18f8-b008-4cbd-b6d2-8c97fe7e9062}\150.0.4078.105\microsoftedge_x64_150.0.4078.105_150.0.4078.99.exe", hr=0x0
2026-08-01T02:12:43.242 Engine:Setting original file name "kernel32" for "c:\windows\system32\en-us\kernel32.dll.mui", hr=0x0
2026-08-01T02:12:43.304 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0
2026-08-01T02:12:44.039 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\wow64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_5e7a191fce5f84c6\rasmigplugin.dll", hr=0x0
2026-08-01T02:12:44.476 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\syswow64\windows.perception.stub.dll", hr=0x0
2026-08-01T02:12:45.289 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.251.5\psmachine_64.dll", hr=0x0
2026-08-01T02:12:46.226 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0
2026-08-01T02:12:46.711 Engine:Setting original file name "VsVersion.dll" for "c:\windows\syswow64\msvcr100_clr0400.dll", hr=0x0
2026-08-01T02:12:47.211 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\747e1cba31508bb6bd65bf9a07892fb2\mscorlib.ni.dll", hr=0x0
2026-08-01T02:12:47.617 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0
2026-08-01T02:12:48.445 Engine:Setting original file name "WinSetupUI.exe" for "c:\windows\system32\winsetupui.dll", hr=0x0
2026-08-01T02:12:48.992 Engine:Setting original file name "NOTEPAD.EXE" for "c:\windows\systemresources\notepad.exe.mun", hr=0x0
2026-08-01T02:12:51.836 Engine:Setting original file name "PlayReady Process EXE" for "c:\windows\system32\prproc.exe", hr=0x0
2026-08-01T02:12:52.758 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mpg4decd.dll", hr=0x0
2026-08-01T02:12:52.773 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0
2026-08-01T02:12:53.304 Engine:Setting original file name "WindowsCodecs" for "c:\windows\system32\windowscodecs.dll", hr=0x0
2026-08-01T02:12:53.539 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\syswow64\servicingcommon.dll", hr=0x0
2026-08-01T02:12:53.711 Engine:Setting original file name "bfsvc.exe" for "c:\windows\system32\ucsvc.exe", hr=0x0
2026-08-01T02:12:53.773 Engine:Setting original file name "audioadg.exe" for "c:\windows\system32\audiodg.exe", hr=0x0
2026-08-01T02:12:53.945 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\system32\mp4sdecd.dll", hr=0x0
2026-08-01T02:12:55.101 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0
2026-08-01T02:12:55.289 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0
2026-08-01T02:12:55.757 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnathlp.dll", hr=0x0
2026-08-01T02:12:58.008 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\syswow64\windowscodecsraw.dll", hr=0x0
2026-08-01T02:12:58.086 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0
2026-08-01T02:12:59.867 Engine:Setting original file name "security.dll" for "c:\windows\syswow64\sspicli.dll", hr=0x0
2026-08-01T02:13:00.367 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\system32\appventsubsystems64.dll", hr=0x0
2026-08-01T02:13:01.429 Engine:Setting original file name "wcp.dll" for "c:\windows\syswow64\ssshim.dll", hr=0x0
2026-08-01T02:13:01.945 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0
2026-08-01T02:13:02.070 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0
2026-08-01T02:13:03.070 Engine:Setting original file name "VsVersion.dll" for "c:\windows\system32\msvcr100_clr0400.dll", hr=0x0
2026-08-01T02:13:03.304 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mp43decd.dll", hr=0x0
2026-08-01T02:13:03.320 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0
2026-08-01T02:13:04.539 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0
2026-08-01T02:13:04.867 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0
2026-08-01T02:13:05.398 Engine:Setting original file name "gdi32" for "c:\windows\system32\gdi32.dll", hr=0x0
2026-08-01T02:13:05.445 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnhupnp.dll", hr=0x0
2026-08-01T02:13:05.914 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnaddr.dll", hr=0x0
2026-08-01T02:13:05.992 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0
2026-08-01T02:13:08.414 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0
2026-08-01T02:13:08.539 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0
2026-08-01T02:13:08.695 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0
2026-08-01T02:13:08.945 Engine:Setting original file name "extractr.exe" for "c:\windows\system32\wimserv.exe", hr=0x0
2026-08-01T02:13:09.757 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnhpast.dll", hr=0x0
2026-08-01T02:13:09.820 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\system32\migisol.dll", hr=0x0
2026-08-01T02:13:10.039 Engine:Setting original file name "WindowsCodecs" for "c:\windows\syswow64\windowscodecs.dll", hr=0x0
2026-08-01T02:13:11.086 Engine:Setting original file name "powershell.exe" for "c:\windows\system32\windowspowershell\v1.0\powershell.exe", hr=0x0
2026-08-01T02:13:11.382 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\syswow64\ddores.dll", hr=0x0
2026-08-01T02:13:11.695 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0
2026-08-01T02:13:12.195 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnet.dll", hr=0x0
2026-08-01T02:13:12.320 Engine:Setting original file name "filterLib.dll" for "c:\windows\syswow64\fltlib.dll", hr=0x0
2026-08-01T02:13:12.648 Engine:Setting original file name "Microsoft(r) DirectX for Windows(r) - Out Of Band" for "c:\program files (x86)\microsoft\edge\application\150.0.4078.105\dxil.dll", hr=0x0
2026-08-01T02:13:14.898 Engine:Setting original file name "dxmasf.dll" for "c:\windows\system32\msdxm.ocx", hr=0x0
2026-08-01T02:13:15.476 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0
2026-08-01T02:13:15.570 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0
2026-08-01T02:13:15.757 Engine:Setting original file name "rundll32.exe" for "c:\windows\syswow64\rundll32.exe", hr=0x0
2026-08-01T02:13:17.070 Engine:Setting original file name "SndVolSSO.dll" for "c:\windows\systemresources\sndvolsso.dll.mun", hr=0x0
2026-08-01T02:13:17.648 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0
2026-08-01T02:13:17.804 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0
2026-08-01T02:13:17.867 Engine:Setting original file name "mavinject64.exe" for "c:\windows\system32\mavinject.exe", hr=0x0
2026-08-01T02:13:17.882 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0
2026-08-01T02:13:18.836 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0
2026-08-01T02:13:19.554 Engine:Setting original file name "aclui.dll" for "c:\windows\winsxs\amd64_microsoft-windows-aclui_31bf3856ad364e35_10.0.20348.3451_none_fd7930e5e5e2f1f1\aclui.dll.mun", hr=0x0
2026-08-01T02:13:19.914 Engine:Setting original file name "dnsapi" for "c:\windows\system32\dnsapi.dll", hr=0x0
2026-08-01T02:13:20.054 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dplaysvr.exe", hr=0x0
2026-08-01T02:13:20.086 Engine:Setting original file name "winsqlite3" for "c:\windows\syswow64\winsqlite3.dll", hr=0x0
2026-08-01T02:13:20.632 Engine:Setting original file name "SHELL32.DLL" for "c:\windows\systemresources\shell32.dll.mun", hr=0x0
2026-08-01T02:13:20.914 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnaddr.dll", hr=0x0
2026-08-01T02:13:21.898 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnet.dll", hr=0x0
2026-08-01T02:13:22.132 Engine:Setting original file name "mapi32.dll" for "c:\windows\system32\mapistub.dll", hr=0x0
2026-08-01T02:13:23.492 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\syswow64\mtf.dll", hr=0x0
2026-08-01T02:13:23.632 Engine:Setting original file name "ACTIONCENTERCPL.DLL" for "c:\windows\systemresources\actioncentercpl.dll.mun", hr=0x0
2026-08-01T02:13:24.070 Engine:Setting original file name "UNPShared.dll" for "c:\windows\system32\upshared.dll", hr=0x0
2026-08-01T02:13:24.132 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnhpast.dll", hr=0x0
2026-08-01T02:13:24.648 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0
2026-08-01T02:13:25.023 Engine:Setting original file name " " for "c:\program files (x86)\microsoft\edge\application\150.0.4078.105\dxcompiler.dll", hr=0x0
2026-08-01T02:13:25.695 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\syswow64\migisol.dll", hr=0x0
2026-08-01T02:13:26.492 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasapi_31bf3856ad364e35_10.0.20348.4767_none_15865bee81d96dc8\pbkmigr.dll", hr=0x0
2026-08-01T02:13:26.711 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\system32\windows.perception.stub.dll", hr=0x0
2026-08-01T02:13:27.336 Engine:Setting original file name "mmcndmgr.dll" for "c:\windows\systemresources\mmcndmgr.dll.mun", hr=0x0
2026-08-01T02:13:27.492 Engine:Setting original file name "mapistub.dll" for "c:\windows\syswow64\mapi32.dll", hr=0x0
2026-08-01T02:13:28.898 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0
2026-08-01T02:13:28.976 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0
2026-08-01T02:13:29.851 Engine:Setting original file name "CRYPTUI.DLL" for "c:\windows\systemresources\cryptui.dll.mun", hr=0x0
2026-08-01T02:13:31.023 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\syswow64\textinputframework.dll", hr=0x0
2026-08-01T02:13:31.992 Engine:Setting original file name "mmcbase.dll" for "c:\windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.20348.4163_none_b803623ca7c56bdc\mmcbase.dll.mun", hr=0x0
2026-08-01T02:13:32.164 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0
2026-08-01T02:13:32.320 Engine:Setting original file name "mavinject32.exe" for "c:\windows\syswow64\mavinject.exe", hr=0x0
2026-08-01T02:13:32.382 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0
2026-08-01T02:13:32.539 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0
2026-08-01T02:13:36.039 Engine:Setting original file name "libssl" for "c:\program files\certbot\python\libssl-1_1.dll", hr=0x0
2026-08-01T02:13:36.773 Engine:Setting original file name "spwizres.dll" for "c:\windows\system32\spwizimg.dll", hr=0x0
2026-08-01T02:13:40.148 Engine:Setting original file name "Apphelp" for "c:\windows\syswow64\apphelp.dll", hr=0x0
2026-08-01T02:13:40.664 Engine:Setting original file name "MSPAINT.EXE" for "c:\windows\systemresources\mspaint.exe.mun", hr=0x0
2026-08-01T02:13:40.820 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0
2026-08-01T02:13:42.148 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\system32\mp43decd.dll", hr=0x0
2026-08-01T02:13:43.179 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0
2026-08-01T02:13:44.398 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpwsockx.dll", hr=0x0
2026-08-01T02:13:44.461 Engine:Setting original file name "Windows.Security.Credentials.UI.CredentialPicker.exe" for "c:\windows\syswow64\windows.security.credentials.ui.credentialpicker.dll", hr=0x0
2026-08-01T02:13:45.429 Engine:Setting original file name "user32" for "c:\windows\system32\user32.dll", hr=0x0
2026-08-01T02:13:46.039 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.foundation.winmd", hr=0x0
2026-08-01T02:13:46.242 Engine:Setting original file name "Apphelp" for "c:\windows\system32\apphelp.dll", hr=0x0
2026-08-01T02:13:47.570 Engine:Setting original file name "osloader.exe" for "c:\windows\system32\winload.exe", hr=0x0
2026-08-01T02:13:48.164 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0
2026-08-01T02:13:49.664 Engine:Setting original file name "mpengine.dll" for "c:\programdata\microsoft\windows defender\definition updates\stableengineetwlocation\mpengine_etw.dll", hr=0x0
2026-08-01T02:13:50.976 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0
2026-08-01T02:13:51.586 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\syswow64\appventsubsystems32.dll", hr=0x0
2026-08-01T02:13:51.882 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0
2026-08-01T02:13:52.429 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T02:13:52.523 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\syswow64\setup\pbkmigr.dll", hr=0x0
2026-08-01T02:13:52.539 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnathlp.dll", hr=0x0
2026-08-01T02:13:52.539 Engine:Setting original file name "Windows.Security.Credentials.UI.CredentialPicker.exe" for "c:\windows\system32\windows.security.credentials.ui.credentialpicker.dll", hr=0x0
2026-08-01T02:13:53.101 Engine:Setting original file name "libcrypto" for "c:\program files\certbot\python\libcrypto-1_1.dll", hr=0x0
2026-08-01T02:13:54.648 Engine:Setting original file name "reg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.20348.1_none_bb033180f3b60f5e\reg.exe", hr=0x0
2026-08-01T02:13:56.257 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0
2026-08-01T02:13:58.476 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\system32\ucrtbase_enclave.dll", hr=0x0
2026-08-01T02:14:00.711 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dplayx.dll", hr=0x0
2026-08-01T02:14:00.929 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32full.dll", hr=0x0
2026-08-01T02:14:02.523 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0
2026-08-01T02:14:02.617 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0
2026-08-01T02:14:03.211 Engine:Setting original file name "mf.dll" for "c:\windows\syswow64\mfpmp.exe", hr=0x0
2026-08-01T02:14:05.445 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0
2026-08-01T02:14:05.539 Engine:Setting original file name "Vulkan Runtime" for "c:\program files (x86)\microsoft\edge\application\150.0.4078.105\vulkan-1.dll", hr=0x0
2026-08-01T02:14:06.695 Engine:Setting original file name "schtasks.exe" for "c:\windows\system32\schtasks.exe", hr=0x0
2026-08-01T02:14:07.539 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0
2026-08-01T02:14:08.351 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0
2026-08-01T02:14:08.351 Engine:Setting original file name "msfltr32.acm" for "c:\windows\syswow64\msacm32.dll", hr=0x0
2026-08-01T02:14:08.851 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0
2026-08-01T02:14:08.882 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0
2026-08-01T02:14:09.132 Engine:Setting original file name "dual_engine_adapter.dll" for "c:\program files (x86)\microsoft\edge\application\150.0.4078.105\dual_engine_adapter_x64.dll", hr=0x0
2026-08-01T02:14:09.148 Engine:Setting original file name "MrmCore.dll" for "c:\windows\syswow64\mrmcorer.dll", hr=0x0
2026-08-01T02:14:10.554 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\system32\applytrustoffline.exe", hr=0x0
2026-08-01T02:14:11.523 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnhupnp.dll", hr=0x0
2026-08-01T02:14:11.648 Engine:Setting original file name "vssadmin.exe" for "c:\windows\system32\vssadmin.exe", hr=0x0
2026-08-01T02:14:11.757 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0
2026-08-01T02:14:12.492 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0
2026-08-01T02:14:13.054 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\system32\bcp47langs.dll", hr=0x0
2026-08-01T02:14:13.414 Engine:Setting original file name "stobject.dll" for "c:\windows\systemresources\stobject.dll.mun", hr=0x0
2026-08-01T02:14:13.445 Engine:Setting original file name "schtasks.exe" for "c:\windows\syswow64\schtasks.exe", hr=0x0
2026-08-01T02:14:15.336 OriginalFileName Maintenance::9110 files in Moac, 0 skipped (cached), 170 filename set
2026-08-01T02:14:15.336 [AutoPurge] Routine task for Cache Maintenance has ended.
2026-08-01T02:23:26.992 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 18894, Count: 706, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-01T02:23:26.992 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 10696, Count: 424, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-08-01T02:23:26.992 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 8873, Count: 443, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\calendar.php, EstimatedImpact: 0%
2026-08-01T02:23:26.992 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 4666, Count: 7140, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24a6-0.MAI, EstimatedImpact: 0%
2026-08-01T02:23:26.992 ProcessImageName: powershell.exe, Pid: 6020, TotalTime: 2069, Count: 106, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 39%
2026-08-01T02:23:26.992 ProcessImageName: AgentShellService.exe, Pid: 1376, TotalTime: 1073, Count: 20, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 61%
2026-08-01T02:23:26.992 ProcessImageName: WmiPrvSE.exe, Pid: 5216, TotalTime: 1001, Count: 26, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 7%
2026-08-01T02:23:26.992 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 734, Count: 35, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-01T02:23:26.992 ProcessImageName: WmiPrvSE.exe, Pid: 8536, TotalTime: 372, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\win32kbase.sys, EstimatedImpact: 0%
2026-08-01T02:23:26.992 ProcessImageName: ngentask.exe, Pid: 5544, TotalTime: 228, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 41%
2026-08-01T02:23:26.992 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 152, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-08-01T02:23:26.992 ProcessImageName: ngentask.exe, Pid: 1124, TotalTime: 150, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-08-01T02:23:26.992 ProcessImageName: ngentask.exe, Pid: 1328, TotalTime: 135, Count: 15, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19%
2026-08-01T02:23:26.992 ProcessImageName: ngentask.exe, Pid: 7164, TotalTime: 121, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 20%
2026-08-01T02:23:26.992 ProcessImageName: taskhostw.exe, Pid: 5416, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 17%
2026-08-01T02:23:26.992 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemResources\shsvcs.dll.mun, EstimatedImpact: 0%
2026-08-01T02:23:26.992 ProcessImageName: powershell.exe, Pid: 1856, TotalTime: 91, Count: 6, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp8EF5.tmp, EstimatedImpact: 0%
2026-08-01T02:23:26.992 ProcessImageName: powershell.exe, Pid: 7320, TotalTime: 77, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp7EA9.tmp, EstimatedImpact: 0%
2026-08-01T02:23:26.992 ProcessImageName: cmd.exe, Pid: 2608, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0%
2026-08-01T02:23:26.992 ProcessImageName: taskhostw.exe, Pid: 8644, TotalTime: 76, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SYSTEM, EstimatedImpact: 1%
2026-08-01T02:23:26.992 ProcessImageName: DeviceCensus.exe, Pid: 2284, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 8%
2026-08-01T02:23:26.992 ProcessImageName: cmd.exe, Pid: 5632, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\dumpalldatabases.bat, EstimatedImpact: 0%
2026-08-01T02:23:26.992 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-01T02:23:26.992 ProcessImageName: cmd.exe, Pid: 5968, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog_all_db_backups.txt, EstimatedImpact: 0%
2026-08-01T02:23:26.992 ProcessImageName: mysqldump.exe, Pid: 7340, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 0%
2026-08-01T02:24:29.382 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T02:24:29.382 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T02:24:29.382 [Cloud] Queued cloud request.
2026-08-01T02:24:29.382 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T02:24:29.382 [Cloud] Dequeued cloud request.
2026-08-01T02:24:29.382 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T02:24:29.554 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{883A7773-B7BD-8F3B-70A3-F72BEAB4A312}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 02:24:29
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T02:24:30.054 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T02:28:57.429 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T02:44:02.429 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T02:46:17.820 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T02:46:17.820 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T02:46:17.820 [Cloud] Queued cloud request.
2026-08-01T02:46:17.820 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T02:46:17.820 [Cloud] Dequeued cloud request.
2026-08-01T02:46:17.820 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T02:46:18.007 [Cloud] End of cloud request.
2026-08-01T02:46:18.523 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T02:47:42.179 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T02:47:42.179 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T02:47:42.179 [Cloud] Queued cloud request.
2026-08-01T02:47:42.179 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T02:47:42.179 [Cloud] Dequeued cloud request.
2026-08-01T02:47:42.179 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T02:47:42.366 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{27FA6E0A-BB08-B41A-4679-EB846688E0CE}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 02:47:42
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T02:47:42.882 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T02:48:46.116 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T02:48:46.116 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T02:48:46.116 [Cloud] Queued cloud request.
2026-08-01T02:48:46.116 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T02:48:46.116 [Cloud] Dequeued cloud request.
2026-08-01T02:48:46.116 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T02:48:46.304 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9A3BD0E6-4FF8-CE66-3888-F85DD483E150}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 02:48:46
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T02:48:46.819 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T02:59:04.757 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T02:59:04.757 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T02:59:04.757 [Cloud] Queued cloud request.
2026-08-01T02:59:04.757 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T02:59:04.757 [Cloud] Dequeued cloud request.
2026-08-01T02:59:04.757 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T02:59:04.897 [Cloud] End of cloud request.
2026-08-01T02:59:05.413 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T02:59:07.429 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T03:01:42.507 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T03:01:42.507 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T03:01:42.507 [Cloud] Queued cloud request.
2026-08-01T03:01:42.507 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T03:01:42.507 [Cloud] Dequeued cloud request.
2026-08-01T03:01:42.507 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T03:01:42.663 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{B392C6BE-90FB-6465-D738-C4E663B5BFAA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 03:01:42
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T03:01:43.179 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T03:02:51.475 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T03:02:51.475 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T03:02:51.475 [Cloud] Queued cloud request.
2026-08-01T03:02:51.475 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T03:02:51.475 [Cloud] Dequeued cloud request.
2026-08-01T03:02:51.475 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T03:02:51.632 [Cloud] End of cloud request.
2026-08-01T03:02:52.132 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T03:13:09.616 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T03:13:09.616 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T03:13:09.616 [Cloud] Queued cloud request.
2026-08-01T03:13:09.616 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T03:13:09.616 [Cloud] Dequeued cloud request.
2026-08-01T03:13:09.632 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T03:13:09.819 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{FB47BB30-2156-8A4E-7B2B-F9363D7D321F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 03:13:09
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T03:13:10.319 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T03:14:03.413 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T03:14:03.413 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T03:14:03.413 [Cloud] Queued cloud request.
2026-08-01T03:14:03.413 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T03:14:03.413 [Cloud] Dequeued cloud request.
2026-08-01T03:14:03.413 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T03:14:03.507 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{3B1D3F74-5058-2F7C-F370-7CC4E6A19AEC}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 03:14:03
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T03:14:04.007 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T03:14:12.428 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T03:18:10.553 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T03:18:10.553 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T03:18:10.553 [Cloud] Queued cloud request.
2026-08-01T03:18:10.553 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T03:18:10.553 [Cloud] Dequeued cloud request.
2026-08-01T03:18:10.553 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T03:18:10.741 [Cloud] End of cloud request.
2026-08-01T03:18:11.241 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T03:19:33.741 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T03:19:33.741 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T03:19:33.741 [Cloud] Queued cloud request.
2026-08-01T03:19:33.741 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T03:19:33.741 [Cloud] Dequeued cloud request.
2026-08-01T03:19:33.741 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T03:19:33.928 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{CE3710A6-101B-531E-BD05-C443B8052E26}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 03:19:33
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T03:19:34.428 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T03:29:17.428 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T03:31:09.897 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T03:31:09.897 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T03:31:09.897 [Cloud] Queued cloud request.
2026-08-01T03:31:09.897 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T03:31:09.897 [Cloud] Dequeued cloud request.
2026-08-01T03:31:09.897 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T03:31:10.084 [Cloud] End of cloud request.
2026-08-01T03:31:10.584 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T03:40:04.662 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T03:40:04.662 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T03:40:04.662 [Cloud] Queued cloud request.
2026-08-01T03:40:04.662 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T03:40:04.662 [Cloud] Dequeued cloud request.
2026-08-01T03:40:04.662 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T03:40:04.866 [Cloud] End of cloud request.
2026-08-01T03:40:05.366 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T03:42:11.459 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T03:42:11.459 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T03:42:11.459 [Cloud] Queued cloud request.
2026-08-01T03:42:11.459 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T03:42:11.459 [Cloud] Dequeued cloud request.
2026-08-01T03:42:11.459 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T03:42:11.881 [Cloud] End of cloud request.
2026-08-01T03:42:12.397 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T03:44:22.428 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T03:45:13.694 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T03:45:13.694 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T03:45:13.694 [Cloud] Queued cloud request.
2026-08-01T03:45:13.694 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T03:45:13.694 [Cloud] Dequeued cloud request.
2026-08-01T03:45:13.694 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T03:45:13.897 [Cloud] End of cloud request.
2026-08-01T03:45:14.397 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T03:46:28.631 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T03:46:28.631 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T03:46:28.631 [Cloud] Queued cloud request.
2026-08-01T03:46:28.631 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T03:46:28.631 [Cloud] Dequeued cloud request.
2026-08-01T03:46:28.631 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T03:46:28.819 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{BF0710EB-1C1B-036E-0672-EC56C5244933}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 03:46:28
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T03:46:29.319 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T03:58:52.412 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T03:58:52.412 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T03:58:52.412 [Cloud] Queued cloud request.
2026-08-01T03:58:52.412 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T03:58:52.412 [Cloud] Dequeued cloud request.
2026-08-01T03:58:52.428 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T03:58:52.600 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{62DC7076-CE61-4F8C-A220-F96D812551FF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 03:58:52
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T03:58:53.115 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T03:59:27.428 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T04:00:13.928 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T04:00:13.928 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T04:00:13.928 [Cloud] Queued cloud request.
2026-08-01T04:00:13.928 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T04:00:13.928 [Cloud] Dequeued cloud request.
2026-08-01T04:00:13.928 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T04:00:14.115 [Cloud] End of cloud request.
2026-08-01T04:00:14.615 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T04:11:22.959 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T04:11:22.959 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T04:11:22.959 [Cloud] Queued cloud request.
2026-08-01T04:11:22.959 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T04:11:22.959 [Cloud] Dequeued cloud request.
2026-08-01T04:11:22.959 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T04:11:23.115 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{C01906D9-A51A-5733-25ED-7B3F7598E5CB}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 04:11:23
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T04:11:23.615 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T04:14:32.428 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T04:18:18.537 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T04:18:18.537 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T04:18:18.537 [Cloud] Queued cloud request.
2026-08-01T04:18:18.537 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T04:18:18.537 [Cloud] Dequeued cloud request.
2026-08-01T04:18:18.537 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T04:18:18.693 [Cloud] End of cloud request.
2026-08-01T04:18:19.193 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T04:19:13.099 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T04:19:13.099 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T04:19:13.099 [Cloud] Queued cloud request.
2026-08-01T04:19:13.099 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T04:19:13.099 [Cloud] Dequeued cloud request.
2026-08-01T04:19:13.099 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T04:19:13.193 [Cloud] End of cloud request.
2026-08-01T04:19:13.693 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T04:23:27.006 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 18894, Count: 706, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 15197, Count: 621, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 9904, Count: 488, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\calendar.php, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 4666, Count: 7140, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24a6-0.MAI, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: powershell.exe, Pid: 6020, TotalTime: 2069, Count: 106, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 39%
2026-08-01T04:23:27.006 ProcessImageName: AgentShellService.exe, Pid: 1376, TotalTime: 1073, Count: 20, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 61%
2026-08-01T04:23:27.006 ProcessImageName: WmiPrvSE.exe, Pid: 5216, TotalTime: 1001, Count: 26, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 7%
2026-08-01T04:23:27.006 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 872, Count: 41, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: WmiPrvSE.exe, Pid: 1116, TotalTime: 685, Count: 39, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 51%
2026-08-01T04:23:27.006 ProcessImageName: WmiPrvSE.exe, Pid: 8536, TotalTime: 372, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\win32kbase.sys, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 247, Count: 4, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 243, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: ngentask.exe, Pid: 5544, TotalTime: 228, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 41%
2026-08-01T04:23:27.006 ProcessImageName: ngentask.exe, Pid: 1124, TotalTime: 150, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-08-01T04:23:27.006 ProcessImageName: ngentask.exe, Pid: 1328, TotalTime: 135, Count: 15, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19%
2026-08-01T04:23:27.006 ProcessImageName: ngentask.exe, Pid: 7164, TotalTime: 121, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 20%
2026-08-01T04:23:27.006 ProcessImageName: taskhostw.exe, Pid: 5416, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 17%
2026-08-01T04:23:27.006 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 91, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: powershell.exe, Pid: 1856, TotalTime: 91, Count: 6, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp8EF5.tmp, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: powershell.exe, Pid: 7320, TotalTime: 77, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp7EA9.tmp, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: cmd.exe, Pid: 2608, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: taskhostw.exe, Pid: 8644, TotalTime: 76, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SYSTEM, EstimatedImpact: 1%
2026-08-01T04:23:27.006 ProcessImageName: DeviceCensus.exe, Pid: 2284, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 8%
2026-08-01T04:23:27.006 ProcessImageName: cmd.exe, Pid: 5632, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\dumpalldatabases.bat, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: cmd.exe, Pid: 5968, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog_all_db_backups.txt, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: mysqldump.exe, Pid: 7340, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 0%
2026-08-01T04:23:27.006 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-08-01T04:29:37.427 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T04:44:42.427 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T04:44:55.177 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T04:44:55.177 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T04:44:55.177 [Cloud] Queued cloud request.
2026-08-01T04:44:55.177 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T04:44:55.177 [Cloud] Dequeued cloud request.
2026-08-01T04:44:55.177 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T04:44:55.380 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{11BE2E5A-BA18-6DF9-546F-1C4D191164FA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 04:44:55
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T04:44:55.880 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T04:56:59.927 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T04:56:59.927 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T04:56:59.927 [Cloud] Queued cloud request.
2026-08-01T04:56:59.927 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T04:56:59.927 [Cloud] Dequeued cloud request.
2026-08-01T04:56:59.927 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T04:57:00.099 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{084EEB1C-9387-FB24-F522-67A639CE227C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 04:57:00
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T04:57:00.614 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T04:59:47.427 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T05:03:36.552 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T05:03:36.552 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T05:03:36.552 [Cloud] Queued cloud request.
2026-08-01T05:03:36.552 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T05:03:36.552 [Cloud] Dequeued cloud request.
2026-08-01T05:03:36.552 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T05:03:36.739 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{39B9B5CC-A530-411F-6E3A-E05B5CF3CC94}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 05:03:36
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T05:03:37.255 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T05:13:01.145 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T05:13:01.145 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T05:13:01.145 [Cloud] Queued cloud request.
2026-08-01T05:13:01.145 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T05:13:01.145 [Cloud] Dequeued cloud request.
2026-08-01T05:13:01.145 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{B216B1A2-CDF9-D192-687A-84BE30BDB06A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 05:13:01
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T05:13:01.333 [Cloud] End of cloud request.
2026-08-01T05:13:01.833 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T05:14:52.427 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T05:17:21.411 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T05:17:21.411 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T05:17:21.411 [Cloud] Queued cloud request.
2026-08-01T05:17:21.411 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T05:17:21.411 [Cloud] Dequeued cloud request.
2026-08-01T05:17:21.426 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T05:17:21.598 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4801F62B-5E48-E4C3-075D-215D01490227}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 05:17:21
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T05:17:22.114 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T05:17:44.598 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T05:17:44.598 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T05:17:44.598 [Cloud] Queued cloud request.
2026-08-01T05:17:44.598 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T05:17:44.598 [Cloud] Dequeued cloud request.
2026-08-01T05:17:44.598 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T05:17:44.692 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{A7CBBB6B-4F93-0B81-8CD9-D34570B453D1}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 05:17:44
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T05:17:45.192 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T05:29:28.426 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T05:29:28.426 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T05:29:28.426 [Cloud] Queued cloud request.
2026-08-01T05:29:28.426 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T05:29:28.426 [Cloud] Dequeued cloud request.
2026-08-01T05:29:28.426 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T05:29:28.630 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4EB55B28-A40E-27DD-1F80-9A033681C1FC}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 05:29:28
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T05:29:29.130 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T05:29:57.426 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T05:31:01.958 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T05:31:01.958 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T05:31:01.958 [Cloud] Queued cloud request.
2026-08-01T05:31:01.958 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T05:31:01.958 [Cloud] Dequeued cloud request.
2026-08-01T05:31:01.958 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T05:31:02.161 [Cloud] End of cloud request.
2026-08-01T05:31:02.676 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T05:31:36.333 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T05:31:36.333 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T05:31:36.333 [Cloud] Queued cloud request.
2026-08-01T05:31:36.333 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T05:31:36.333 [Cloud] Dequeued cloud request.
2026-08-01T05:31:36.333 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T05:31:36.411 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{C6B1D9E1-0C05-B927-FA93-386C8F487208}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 05:31:36
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T05:31:36.926 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T05:34:53.504 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T05:34:53.504 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T05:34:53.504 [Cloud] Queued cloud request.
2026-08-01T05:34:53.504 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T05:34:53.504 [Cloud] Dequeued cloud request.
2026-08-01T05:34:53.504 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T05:34:53.676 [Cloud] End of cloud request.
2026-08-01T05:34:54.176 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T05:37:54.004 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T05:37:54.004 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T05:37:54.004 [Cloud] Queued cloud request.
2026-08-01T05:37:54.004 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T05:37:54.004 [Cloud] Dequeued cloud request.
2026-08-01T05:37:54.192 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T05:37:54.364 [Cloud] End of cloud request.
2026-08-01T05:37:54.864 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T05:45:02.426 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T05:58:00.270 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T05:58:00.270 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T05:58:00.270 [Cloud] Queued cloud request.
2026-08-01T05:58:00.270 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T05:58:00.270 [Cloud] Dequeued cloud request.
2026-08-01T05:58:00.270 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T05:58:02.270 [Cloud] End of cloud request.
2026-08-01T05:58:02.785 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T05:58:07.957 ReportLowfi(ctfmon.exe, 0x437a0835) from 0x0006b6bd6566d2d9
2026-08-01T05:58:09.252 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\PrsDE41.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8014431, FileId: 0x80000000c4a1f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T05:58:11.238 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\PrsE5C4.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8014706, FileId: 0xc0000000c4c92, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T05:58:14.784 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\PrsF3DF.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8015191, FileId: 0x70000000c4cec, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T06:00:07.426 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T06:01:32.270 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T06:01:32.270 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T06:01:32.270 [Cloud] Queued cloud request.
2026-08-01T06:01:32.270 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T06:01:32.270 [Cloud] Dequeued cloud request.
2026-08-01T06:01:32.270 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T06:01:32.488 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{FA6A9A03-F935-48AC-4AE1-2C183E6AF741}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 06:01:32
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T06:01:32.988 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T06:02:08.457 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T06:02:08.457 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T06:02:08.457 [Cloud] Queued cloud request.
2026-08-01T06:02:08.457 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T06:02:08.457 [Cloud] Dequeued cloud request.
2026-08-01T06:02:08.457 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T06:02:08.551 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{DBD2E699-3A97-82B6-5C80-B532FC0D9F20}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 06:02:08
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T06:02:09.051 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T06:07:01.410 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T06:07:01.410 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T06:07:01.410 [Cloud] Queued cloud request.
2026-08-01T06:07:01.410 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T06:07:01.426 [Cloud] Dequeued cloud request.
2026-08-01T06:07:01.426 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T06:07:01.598 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{480E35AC-E212-6E95-3A31-2ABC97E53E0A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 06:07:01
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T06:07:02.098 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T06:15:12.426 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T06:16:43.394 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T06:16:43.394 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T06:16:43.394 [Cloud] Queued cloud request.
2026-08-01T06:16:43.394 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T06:16:43.394 [Cloud] Dequeued cloud request.
2026-08-01T06:16:43.394 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T06:16:43.582 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{0C57F339-D419-A316-876D-70FEDB37BCED}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 06:16:43
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T06:16:44.098 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T06:23:27.004 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 19591, Count: 813, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 18894, Count: 706, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 10536, Count: 507, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 4666, Count: 7140, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24a6-0.MAI, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: powershell.exe, Pid: 6020, TotalTime: 2069, Count: 106, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 39%
2026-08-01T06:23:27.004 ProcessImageName: explorer.exe, Pid: 9156, TotalTime: 1300, Count: 63, MaxTime: 343, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 3%
2026-08-01T06:23:27.004 ProcessImageName: RuntimeBroker.exe, Pid: 2172, TotalTime: 1185, Count: 9, MaxTime: 375, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Migration\MEMigrate.exe, EstimatedImpact: 41%
2026-08-01T06:23:27.004 ProcessImageName: AgentShellService.exe, Pid: 1376, TotalTime: 1073, Count: 20, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 61%
2026-08-01T06:23:27.004 ProcessImageName: WmiPrvSE.exe, Pid: 5216, TotalTime: 1001, Count: 26, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 7%
2026-08-01T06:23:27.004 ProcessImageName: AgentShellSystemTray.exe, Pid: 6124, TotalTime: 990, Count: 40, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 28%
2026-08-01T06:23:27.004 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 964, Count: 45, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: sdiagnhost.exe, Pid: 7540, TotalTime: 790, Count: 30, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad78daf4#\5c9dd78ce79da42d2defa70b5dd1fdfc\Microsoft.Windows.Diagnosis.SDHost.ni.dll, EstimatedImpact: 26%
2026-08-01T06:23:27.004 ProcessImageName: WmiPrvSE.exe, Pid: 1116, TotalTime: 685, Count: 39, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 51%
2026-08-01T06:23:27.004 ProcessImageName: runonce.exe, Pid: 3304, TotalTime: 556, Count: 14, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 29%
2026-08-01T06:23:27.004 ProcessImageName: WmiPrvSE.exe, Pid: 8536, TotalTime: 372, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\win32kbase.sys, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: taskhostw.exe, Pid: 7488, TotalTime: 337, Count: 16, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\SDIAG_b9bdefc9-5d1a-4ffd-ae40-4f9a21ff33f7\DiagPackage.diagpkg, EstimatedImpact: 67%
2026-08-01T06:23:27.004 ProcessImageName: python.exe, Pid: 7840, TotalTime: 321, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 10%
2026-08-01T06:23:27.004 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 308, Count: 16, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_c9dc6fe1ea5611d7\Amd64\MSAppMon.xml, EstimatedImpact: 5%
2026-08-01T06:23:27.004 ProcessImageName: powershell.exe, Pid: 6360, TotalTime: 294, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 26%
2026-08-01T06:23:27.004 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 274, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 247, Count: 4, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: ngentask.exe, Pid: 5544, TotalTime: 228, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 41%
2026-08-01T06:23:27.004 ProcessImageName: ngentask.exe, Pid: 1124, TotalTime: 150, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-08-01T06:23:27.004 ProcessImageName: ngentask.exe, Pid: 1328, TotalTime: 135, Count: 15, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19%
2026-08-01T06:23:27.004 ProcessImageName: svchost.exe, Pid: 6088, TotalTime: 122, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator.cdpresource, EstimatedImpact: 2%
2026-08-01T06:23:27.004 ProcessImageName: ngentask.exe, Pid: 7164, TotalTime: 121, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 20%
2026-08-01T06:23:27.004 ProcessImageName: taskhostw.exe, Pid: 5416, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 17%
2026-08-01T06:23:27.004 ProcessImageName: powershell.exe, Pid: 1856, TotalTime: 91, Count: 6, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp8EF5.tmp, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 91, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: powershell.exe, Pid: 7320, TotalTime: 77, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp7EA9.tmp, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: svchost.exe, Pid: 1360, TotalTime: 77, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\prn0013.tmp, EstimatedImpact: 1%
2026-08-01T06:23:27.004 ProcessImageName: cmd.exe, Pid: 2608, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: taskhostw.exe, Pid: 8644, TotalTime: 76, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SYSTEM, EstimatedImpact: 1%
2026-08-01T06:23:27.004 ProcessImageName: DeviceCensus.exe, Pid: 2284, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 8%
2026-08-01T06:23:27.004 ProcessImageName: cmd.exe, Pid: 5632, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\dumpalldatabases.bat, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: cmd.exe, Pid: 5968, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog_all_db_backups.txt, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: mysqldump.exe, Pid: 7340, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-08-01T06:23:27.004 ProcessImageName: DismHost.exe, Pid: 8056, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{c76cbcad-afc9-11eb-8234-000d3aa6d50e}.TM.blf, EstimatedImpact: 1%
2026-08-01T06:23:27.004 ProcessImageName: AggregatorHost.exe, Pid: 4104, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0%
2026-08-01T06:28:19.925 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T06:28:19.925 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T06:28:19.925 [Cloud] Queued cloud request.
2026-08-01T06:28:19.925 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T06:28:19.925 [Cloud] Dequeued cloud request.
2026-08-01T06:28:19.925 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T06:28:20.066 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{8130A1C4-000E-5D54-D31C-F4E59AD47F64}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 06:28:20
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T06:28:20.582 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T06:29:05.691 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T06:29:05.691 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T06:29:05.691 [Cloud] Queued cloud request.
2026-08-01T06:29:05.691 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T06:29:05.691 [Cloud] Dequeued cloud request.
2026-08-01T06:29:05.707 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T06:29:05.847 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{3B078B91-AC72-E560-2572-A800782967A0}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 06:29:05
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T06:29:06.363 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T06:29:07.050 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T06:29:07.050 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T06:29:07.050 [Cloud] Queued cloud request.
2026-08-01T06:29:07.050 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T06:29:07.050 [Cloud] Dequeued cloud request.
2026-08-01T06:29:07.050 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T06:29:07.129 [Cloud] End of cloud request.
2026-08-01T06:29:07.644 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T06:30:17.425 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T06:32:39.941 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T06:32:39.941 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T06:32:39.941 [Cloud] Queued cloud request.
2026-08-01T06:32:39.941 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T06:32:39.941 [Cloud] Dequeued cloud request.
2026-08-01T06:32:39.941 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T06:32:40.097 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{8CA1220A-47DF-F83C-2849-EF479AEE088B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 06:32:40
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T06:32:40.613 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T06:45:22.425 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T06:55:13.628 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T06:55:13.628 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T06:55:13.628 [Cloud] Queued cloud request.
2026-08-01T06:55:13.628 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T06:55:13.628 [Cloud] Dequeued cloud request.
2026-08-01T06:55:13.628 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T06:55:13.816 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{0EA562E4-2F8D-1AF9-941C-A3B7731FD21B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 06:55:13
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T06:55:14.316 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T06:57:05.597 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T06:57:05.597 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T06:57:05.597 [Cloud] Queued cloud request.
2026-08-01T06:57:05.597 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T06:57:05.597 [Cloud] Dequeued cloud request.
2026-08-01T06:57:05.612 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T06:57:05.753 [Cloud] End of cloud request.
2026-08-01T06:57:06.253 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:00:27.421 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T07:02:37.550 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:02:37.550 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:02:37.550 [Cloud] Queued cloud request.
2026-08-01T07:02:37.550 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:02:37.550 [Cloud] Dequeued cloud request.
2026-08-01T07:02:37.550 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T07:02:37.706 [Cloud] End of cloud request.
2026-08-01T07:02:38.222 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:05:14.737 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:05:14.737 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:05:14.737 [Cloud] Queued cloud request.
2026-08-01T07:05:14.737 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:05:14.737 [Cloud] Dequeued cloud request.
2026-08-01T07:05:14.753 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T07:05:14.894 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E737C4FE-3D6A-AC3D-6946-1FE22F23087A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 07:05:14
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T07:05:15.409 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:12:09.081 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8042501, FileId: 0x300000001025a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T07:12:09.425 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8042507, FileId: 0x5000000007758, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T07:13:50.355 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:13:50.355 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:13:50.355 [Cloud] Queued cloud request.
2026-08-01T07:13:50.355 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:13:50.355 [Cloud] Dequeued cloud request.
2026-08-01T07:13:50.371 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T07:13:50.543 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9455327E-2F92-14CE-A823-C967360FA000}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 07:13:50
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T07:13:51.043 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:14:27.736 ReportLowfi(ctfmon.exe, 0x437a0835) from 0x0006b6bd6566d2d9
2026-08-01T07:14:29.336 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\PrsC0F1.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8043907, FileId: 0x9000000006ef8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T07:14:30.820 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:14:30.820 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:14:30.820 [Cloud] Queued cloud request.
2026-08-01T07:14:30.820 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:14:30.820 [Cloud] Dequeued cloud request.
2026-08-01T07:14:30.852 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T07:14:31.050 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F3E6F5DE-05AB-57CD-069F-394A373C8FD0}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 07:14:31
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T07:14:31.643 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:14:31.652 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\PrsCA49.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8044118, FileId: 0xc9000000007000, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T07:14:35.846 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\PrsDAB5.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8044384, FileId: 0x6000000007400, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T07:15:32.417 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000082E7D016800E, sigsha=66f0ba88504439deb1a5ee4ef0979978d2d6e2e2, cached=false, source=0, resourceid=0x05e8edb4
Internal signature match:subtype=Lowfi, sigseq=0x000082E7F0901A0A, sigsha=7902eb5d39888eb083c7611e8a99d25d9c960c3b, cached=false, source=0, resourceid=0x05e8edb4
Internal signature match:subtype=Lowfi, sigseq=0x000093E7460D9B1C, sigsha=7109779aa06d65059abc52081b403e47b815790e, cached=false, source=0, resourceid=0x05e8edb4
2026-08-01T07:16:39.949 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:16:39.950 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:16:39.950 [Cloud] Queued cloud request.
2026-08-01T07:16:39.950 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:16:39.950 [Cloud] Dequeued cloud request.
2026-08-01T07:16:39.951 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\1acbb22e3028186c79f4364c823b7bbfc852979f
Dynamic Signature Compilation Timestamp:08-01-2026 07:16:40
Persistence Type:Duration
Time remaining:50065408
2026-08-01T07:16:40.171 Dynamic signature received
2026-08-01T07:16:40.173 [Cloud] End of cloud request.
2026-08-01T07:16:40.174 RTSD:RTSD recieved, rescanning impacted resources
2026-08-01T07:16:40.688 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:17:41.737 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:17:41.737 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:17:41.737 [Cloud] Queued cloud request.
2026-08-01T07:17:41.737 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:17:41.737 [Cloud] Dequeued cloud request.
2026-08-01T07:17:41.737 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T07:17:41.925 [Cloud] End of cloud request.
2026-08-01T07:17:42.425 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:28:12.954 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:28:12.954 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:28:12.954 [Cloud] Queued cloud request.
2026-08-01T07:28:12.954 [Cloud] Dequeued cloud request.
2026-08-01T07:28:12.954 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:28:12.966 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{E85B17E7-71F6-9045-2A38-2995646F058E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 07:28:13
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T07:28:13.417 [Cloud] End of cloud request.
2026-08-01T07:28:13.939 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:28:23.659 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:28:23.659 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:28:23.659 [Cloud] Queued cloud request.
2026-08-01T07:28:23.659 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:28:23.659 [Cloud] Dequeued cloud request.
2026-08-01T07:28:23.659 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T07:28:23.738 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{68F26B14-0476-FF23-893D-256094C12ED7}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 07:28:23
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T07:28:24.253 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:30:37.424 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T07:34:14.674 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:34:14.674 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:34:14.674 [Cloud] Queued cloud request.
2026-08-01T07:34:14.674 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:34:14.674 [Cloud] Dequeued cloud request.
2026-08-01T07:34:14.674 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T07:34:14.862 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{FE565C21-6ADD-2FD8-8C5F-460E8F35740D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 07:34:14
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T07:34:15.362 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:37:31.674 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:37:31.674 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:37:31.674 [Cloud] Queued cloud request.
2026-08-01T07:37:31.674 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:37:31.674 [Cloud] Dequeued cloud request.
2026-08-01T07:37:31.674 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T07:37:31.862 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{D45A6A4C-B668-F94D-425E-D481F4D90C54}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 07:37:31
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T07:37:32.377 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:41:21.471 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:41:21.471 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:41:21.471 [Cloud] Queued cloud request.
2026-08-01T07:41:21.471 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:41:21.471 [Cloud] Dequeued cloud request.
2026-08-01T07:41:21.471 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T07:41:21.627 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{A4FD8B7C-1F12-9AF5-A2F5-986079388E39}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 07:41:21
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T07:41:22.143 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:41:47.815 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:41:47.815 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:41:47.815 [Cloud] Queued cloud request.
2026-08-01T07:41:47.815 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:41:47.815 [Cloud] Dequeued cloud request.
2026-08-01T07:41:47.815 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T07:41:47.893 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{56C8DE52-AC4E-DE18-A07C-D243F5600E04}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 07:41:47
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T07:41:48.408 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:45:21.690 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:45:21.690 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:45:21.690 [Cloud] Queued cloud request.
2026-08-01T07:45:21.690 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:45:21.690 [Cloud] Dequeued cloud request.
2026-08-01T07:45:21.690 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T07:45:21.846 [Cloud] End of cloud request.
2026-08-01T07:45:22.362 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:45:42.424 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T07:48:22.346 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:48:22.346 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:48:22.346 [Cloud] Queued cloud request.
2026-08-01T07:48:22.346 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:48:22.346 [Cloud] Dequeued cloud request.
2026-08-01T07:48:22.346 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T07:48:22.533 [Cloud] End of cloud request.
2026-08-01T07:48:23.033 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:51:07.268 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:51:07.268 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:51:07.268 [Cloud] Queued cloud request.
2026-08-01T07:51:07.268 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:51:07.268 [Cloud] Dequeued cloud request.
2026-08-01T07:51:07.268 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T07:51:07.408 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{63CA536A-EBAA-ED7D-8BD8-562709A951EC}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 07:51:07
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T07:51:07.908 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T07:58:31.920 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T07:58:31.920 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T07:58:31.920 [Cloud] Queued cloud request.
2026-08-01T07:58:31.920 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T07:58:31.920 [Cloud] Dequeued cloud request.
2026-08-01T07:58:31.920 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T07:58:32.123 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{AD2D8BAC-C6F0-3D3A-939D-2B81944663C7}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 07:58:32
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T07:58:32.623 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T08:00:47.424 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T08:06:15.237 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T08:06:15.237 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T08:06:15.237 [Cloud] Queued cloud request.
2026-08-01T08:06:15.237 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T08:06:15.237 [Cloud] Dequeued cloud request.
2026-08-01T08:06:15.252 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T08:06:15.440 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{54E0AF17-096D-3D26-BBAA-F680D3D2194E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 08:06:15
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T08:06:15.955 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T08:15:52.424 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T08:23:27.017 ProcessImageName: explorer.exe, Pid: 6304, TotalTime: 26070, Count: 544, MaxTime: 1265, MaxTimeFile: \Device\HarddiskVolume2\win-acme\wacs.exe, EstimatedImpact: 2%
2026-08-01T08:23:27.017 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 23878, Count: 1006, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 18894, Count: 706, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 11260, Count: 539, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 4666, Count: 7140, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24a6-0.MAI, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: powershell.exe, Pid: 6020, TotalTime: 2069, Count: 106, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 39%
2026-08-01T08:23:27.017 ProcessImageName: explorer.exe, Pid: 9156, TotalTime: 1728, Count: 84, MaxTime: 343, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: RuntimeBroker.exe, Pid: 2172, TotalTime: 1216, Count: 10, MaxTime: 375, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Migration\MEMigrate.exe, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1181, Count: 50, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: AgentShellService.exe, Pid: 1376, TotalTime: 1073, Count: 20, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 61%
2026-08-01T08:23:27.017 ProcessImageName: WmiPrvSE.exe, Pid: 5216, TotalTime: 1001, Count: 26, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 7%
2026-08-01T08:23:27.017 ProcessImageName: AgentShellSystemTray.exe, Pid: 6124, TotalTime: 990, Count: 40, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 28%
2026-08-01T08:23:27.017 ProcessImageName: explorer.exe, Pid: 7912, TotalTime: 873, Count: 45, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\SSL.txt.lnk, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: sdiagnhost.exe, Pid: 7540, TotalTime: 790, Count: 30, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad78daf4#\5c9dd78ce79da42d2defa70b5dd1fdfc\Microsoft.Windows.Diagnosis.SDHost.ni.dll, EstimatedImpact: 26%
2026-08-01T08:23:27.017 ProcessImageName: WmiPrvSE.exe, Pid: 1116, TotalTime: 685, Count: 39, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 51%
2026-08-01T08:23:27.017 ProcessImageName: mmc.exe, Pid: 6276, TotalTime: 567, Count: 29, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\MMCEx\f47c37b958419138e250638e2059ed08\MMCEx.ni.dll, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: wacs.exe, Pid: 5856, TotalTime: 564, Count: 28, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\win-acme\acme-v02.api.letsencrypt.org\public_suffix_list.dat, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: runonce.exe, Pid: 3304, TotalTime: 556, Count: 14, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 29%
2026-08-01T08:23:27.017 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 385, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_c9dc6fe1ea5611d7\Amd64\MSAppMon.xml, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: explorer.exe, Pid: 5596, TotalTime: 385, Count: 13, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemResources\accessibilitycpl.dll.mun, EstimatedImpact: 71%
2026-08-01T08:23:27.017 ProcessImageName: WmiPrvSE.exe, Pid: 8536, TotalTime: 372, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\win32kbase.sys, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: taskhostw.exe, Pid: 7488, TotalTime: 337, Count: 16, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\SDIAG_b9bdefc9-5d1a-4ffd-ae40-4f9a21ff33f7\DiagPackage.diagpkg, EstimatedImpact: 67%
2026-08-01T08:23:27.017 ProcessImageName: python.exe, Pid: 7840, TotalTime: 321, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 10%
2026-08-01T08:23:27.017 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 320, Count: 17, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: powershell.exe, Pid: 6360, TotalTime: 294, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 26%
2026-08-01T08:23:27.017 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 247, Count: 4, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: dllhost.exe, Pid: 7640, TotalTime: 241, Count: 19, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: dllhost.exe, Pid: 9168, TotalTime: 229, Count: 18, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: ngentask.exe, Pid: 5544, TotalTime: 228, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 41%
2026-08-01T08:23:27.017 ProcessImageName: ngentask.exe, Pid: 1124, TotalTime: 150, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-08-01T08:23:27.017 ProcessImageName: wacs.exe, Pid: 5992, TotalTime: 139, Count: 6, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\win-acme\acme-v02.api.letsencrypt.org\public_suffix_list.dat, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: ngentask.exe, Pid: 1328, TotalTime: 135, Count: 15, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19%
2026-08-01T08:23:27.017 ProcessImageName: svchost.exe, Pid: 1360, TotalTime: 122, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\prn0013.tmp, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: svchost.exe, Pid: 8468, TotalTime: 122, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\msedgeedge_BITS_9152_838833772\BIT945A.tmp, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: svchost.exe, Pid: 6088, TotalTime: 122, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator.cdpresource, EstimatedImpact: 2%
2026-08-01T08:23:27.017 ProcessImageName: ngentask.exe, Pid: 7164, TotalTime: 121, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 20%
2026-08-01T08:23:27.017 ProcessImageName: python.exe, Pid: 6856, TotalTime: 107, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Certbot\accounts\acme-v02.api.letsencrypt.org\directory\612050855f7c1a31bed06818996045ed\regr.json, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: taskhostw.exe, Pid: 5416, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 17%
2026-08-01T08:23:27.017 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 91, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: powershell.exe, Pid: 1856, TotalTime: 91, Count: 6, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp8EF5.tmp, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: powershell.exe, Pid: 7320, TotalTime: 77, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp7EA9.tmp, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: python.exe, Pid: 5308, TotalTime: 77, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\auth_handler.py, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: runonce.exe, Pid: 5452, TotalTime: 77, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\Caches\cversions.1.db, EstimatedImpact: 9%
2026-08-01T08:23:27.017 ProcessImageName: cmd.exe, Pid: 2608, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: taskhostw.exe, Pid: 8644, TotalTime: 76, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SYSTEM, EstimatedImpact: 1%
2026-08-01T08:23:27.017 ProcessImageName: OpenWith.exe, Pid: 6360, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemResources\Windows.UI.Immersive.dll.mun, EstimatedImpact: 30%
2026-08-01T08:23:27.017 ProcessImageName: DeviceCensus.exe, Pid: 2284, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 8%
2026-08-01T08:23:27.017 ProcessImageName: cmd.exe, Pid: 5632, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\dumpalldatabases.bat, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: cmd.exe, Pid: 5968, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog_all_db_backups.txt, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: mysqldump.exe, Pid: 7340, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: svchost.exe, Pid: 2532, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\DiagTrack\utc.allow.diffbase, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: DismHost.exe, Pid: 8056, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{c76cbcad-afc9-11eb-8234-000d3aa6d50e}.TM.blf, EstimatedImpact: 1%
2026-08-01T08:23:27.017 ProcessImageName: AggregatorHost.exe, Pid: 4104, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0%
2026-08-01T08:23:27.017 ProcessImageName: svchost.exe, Pid: 2888, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator\ActivitiesCache.db-shm, EstimatedImpact: 0%
2026-08-01T08:23:31.876 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T08:23:31.876 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T08:23:31.876 [Cloud] Queued cloud request.
2026-08-01T08:23:31.876 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T08:23:31.876 [Cloud] Dequeued cloud request.
2026-08-01T08:23:31.876 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T08:23:32.033 [Cloud] End of cloud request.
2026-08-01T08:23:32.548 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T08:27:13.095 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\3\__PSScriptPolicyTest_2auqlo4y.nni.psm1. Process: \Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #8069491, FileId: 0x1600000001bb01, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T08:30:57.423 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T08:34:43.205 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\GPUPersistentCache\DawnGraphiteCache\WRJTYMYAB73RC6HTXXLKRS2FEZVUG6PP\cache.db. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8072058, FileId: 0x8000000007c4c, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T08:35:34.829 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8072359, FileId: 0x90000000100f6, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T08:35:35.210 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8072366, FileId: 0x5000000007757, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T08:37:12.429 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T08:37:12.429 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T08:37:12.429 [Cloud] Queued cloud request.
2026-08-01T08:37:12.429 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T08:37:12.429 [Cloud] Dequeued cloud request.
2026-08-01T08:37:12.429 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T08:37:12.632 [Cloud] End of cloud request.
2026-08-01T08:37:13.132 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T08:37:50.179 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T08:37:50.179 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T08:37:50.179 [Cloud] Queued cloud request.
2026-08-01T08:37:50.179 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T08:37:50.179 [Cloud] Dequeued cloud request.
2026-08-01T08:37:50.179 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T08:37:50.257 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4B370468-00FE-C7D0-D1AE-6E8135CE6591}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 08:37:50
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T08:37:50.757 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T08:40:12.757 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T08:40:12.757 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T08:40:12.757 [Cloud] Queued cloud request.
2026-08-01T08:40:12.757 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T08:40:12.757 [Cloud] Dequeued cloud request.
2026-08-01T08:40:12.757 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T08:40:12.945 [Cloud] End of cloud request.
2026-08-01T08:40:13.445 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T08:41:02.101 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T08:41:02.101 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T08:41:02.101 [Cloud] Queued cloud request.
2026-08-01T08:41:02.101 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T08:41:02.101 [Cloud] Dequeued cloud request.
2026-08-01T08:41:02.101 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T08:41:02.179 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{A6EA4CED-35FC-C5D1-412D-953025FA4A71}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 08:41:02
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T08:41:02.695 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T08:45:50.820 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T08:45:50.820 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T08:45:50.820 [Cloud] Queued cloud request.
2026-08-01T08:45:50.820 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T08:45:50.820 [Cloud] Dequeued cloud request.
2026-08-01T08:45:50.820 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T08:45:51.007 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{615E72DB-588E-29AC-5C60-16938AB8973E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 08:45:51
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T08:45:51.507 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T08:46:02.429 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T08:52:57.570 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T08:52:57.570 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T08:52:57.570 [Cloud] Queued cloud request.
2026-08-01T08:52:57.570 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T08:52:57.788 [Cloud] Dequeued cloud request.
2026-08-01T08:52:57.788 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T08:52:57.976 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{3CE0970E-3A9A-5881-DC40-1376D19CEF3D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 08:52:57
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T08:52:58.491 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T08:55:13.273 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T08:55:13.273 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T08:55:13.273 [Cloud] Queued cloud request.
2026-08-01T08:55:13.273 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T08:55:13.273 [Cloud] Dequeued cloud request.
2026-08-01T08:55:13.273 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T08:55:13.460 [Cloud] End of cloud request.
2026-08-01T08:55:13.976 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T09:01:07.429 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T09:12:50.413 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T09:12:50.413 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T09:12:50.413 [Cloud] Queued cloud request.
2026-08-01T09:12:50.413 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T09:12:50.413 [Cloud] Dequeued cloud request.
2026-08-01T09:12:50.429 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T09:12:50.616 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{B3359EAB-BA82-0D6E-5A81-67D98A91144E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 09:12:50
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T09:12:51.132 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T09:15:07.507 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T09:15:07.507 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T09:15:07.507 [Cloud] Queued cloud request.
2026-08-01T09:15:07.507 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T09:15:07.507 [Cloud] Dequeued cloud request.
2026-08-01T09:15:07.522 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T09:15:07.694 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{A495268B-C196-D59B-A6F5-F1887C8A1B1F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 09:15:07
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T09:15:08.194 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T09:16:12.429 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T09:17:56.960 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T09:17:56.960 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T09:17:56.960 [Cloud] Queued cloud request.
2026-08-01T09:17:56.960 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T09:17:56.960 [Cloud] Dequeued cloud request.
2026-08-01T09:17:56.960 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T09:17:57.147 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{D1D93459-006F-60F5-51BF-D989827FC256}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 09:17:57
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T09:17:57.663 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T09:22:35.788 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T09:22:35.788 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T09:22:35.788 [Cloud] Queued cloud request.
2026-08-01T09:22:35.788 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T09:22:35.788 [Cloud] Dequeued cloud request.
2026-08-01T09:22:35.804 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T09:22:35.991 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{0E6ADD66-CD8E-792A-6FE4-796E47F4067D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 09:22:35
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T09:22:36.491 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T09:23:49.866 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T09:23:49.866 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T09:23:49.866 [Cloud] Queued cloud request.
2026-08-01T09:23:49.866 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T09:23:49.866 [Cloud] Dequeued cloud request.
2026-08-01T09:23:49.866 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T09:23:50.038 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{6B2104D7-1D51-6A05-44C3-005C79A8C8D5}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 09:23:50
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T09:23:50.538 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T09:28:01.944 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T09:28:01.944 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T09:28:01.944 [Cloud] Queued cloud request.
2026-08-01T09:28:01.944 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T09:28:01.944 [Cloud] Dequeued cloud request.
2026-08-01T09:28:01.944 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T09:28:02.085 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{182EAC2C-151A-BD6A-59DF-37F41CF5EBE5}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 09:28:02
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T09:28:02.600 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T09:31:17.428 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T09:43:07.069 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T09:43:07.069 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T09:43:07.069 [Cloud] Queued cloud request.
2026-08-01T09:43:07.069 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T09:43:07.069 [Cloud] Dequeued cloud request.
2026-08-01T09:43:07.069 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T09:43:07.225 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{AC7D030C-0107-1B99-C840-F836FD65CF26}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 09:43:07
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T09:43:07.741 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T09:43:09.569 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T09:43:09.569 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T09:43:09.569 [Cloud] Queued cloud request.
2026-08-01T09:43:09.569 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T09:43:09.569 [Cloud] Dequeued cloud request.
2026-08-01T09:43:09.569 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T09:43:09.663 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{22250926-421D-77DB-DF13-9F2A40BD49DA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 09:43:09
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T09:43:10.178 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T09:46:22.428 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T09:49:56.928 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T09:49:56.928 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T09:49:56.928 [Cloud] Queued cloud request.
2026-08-01T09:49:56.928 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T09:49:56.928 [Cloud] Dequeued cloud request.
2026-08-01T09:49:56.928 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T09:49:57.100 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2733BF65-40E3-DCBE-ACDC-5E62203E72F8}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 09:49:57
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T09:49:57.600 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T09:55:13.803 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T09:55:13.803 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T09:55:13.803 [Cloud] Queued cloud request.
2026-08-01T09:55:13.803 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T09:55:13.803 [Cloud] Dequeued cloud request.
2026-08-01T09:55:13.803 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T09:55:14.022 [Cloud] End of cloud request.
2026-08-01T09:55:14.537 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T09:55:28.740 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T09:55:28.740 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T09:55:28.740 [Cloud] Queued cloud request.
2026-08-01T09:55:28.740 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T09:55:28.740 [Cloud] Dequeued cloud request.
2026-08-01T09:55:28.740 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T09:55:28.819 [Cloud] End of cloud request.
2026-08-01T09:55:29.334 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:00:25.490 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:00:25.490 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:00:25.490 [Cloud] Queued cloud request.
2026-08-01T10:00:25.490 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:00:25.490 [Cloud] Dequeued cloud request.
2026-08-01T10:00:25.490 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T10:00:25.678 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1F17EAE7-6888-1F97-940E-6066210D4249}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 10:00:25
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T10:00:26.193 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:01:02.475 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:01:02.475 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:01:02.475 [Cloud] Queued cloud request.
2026-08-01T10:01:02.475 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:01:02.475 [Cloud] Dequeued cloud request.
2026-08-01T10:01:02.475 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T10:01:02.553 [Cloud] End of cloud request.
2026-08-01T10:01:03.053 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:01:27.428 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T10:02:07.772 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:02:07.772 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:02:07.772 [Cloud] Queued cloud request.
2026-08-01T10:02:07.772 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:02:07.772 [Cloud] Dequeued cloud request.
2026-08-01T10:02:07.772 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T10:02:07.959 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4F9149E8-E3F3-B216-9B6F-49B8C0CF43EA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 10:02:07
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T10:02:08.475 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:15:07.756 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:15:07.756 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:15:07.756 [Cloud] Queued cloud request.
2026-08-01T10:15:07.756 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:15:07.756 [Cloud] Dequeued cloud request.
2026-08-01T10:15:07.756 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T10:15:07.959 [Cloud] End of cloud request.
2026-08-01T10:15:08.459 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:16:32.427 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T10:17:27.865 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:17:27.865 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:17:27.865 [Cloud] Queued cloud request.
2026-08-01T10:17:27.865 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:17:27.865 [Cloud] Dequeued cloud request.
2026-08-01T10:17:27.865 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T10:17:28.052 [Cloud] End of cloud request.
2026-08-01T10:17:28.552 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:18:29.474 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:18:29.474 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:18:29.474 [Cloud] Queued cloud request.
2026-08-01T10:18:29.474 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:18:29.474 [Cloud] Dequeued cloud request.
2026-08-01T10:18:29.490 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T10:18:29.662 [Cloud] End of cloud request.
2026-08-01T10:18:30.177 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:19:11.099 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:19:11.099 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:19:11.099 [Cloud] Queued cloud request.
2026-08-01T10:19:11.099 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:19:11.099 [Cloud] Dequeued cloud request.
2026-08-01T10:19:11.099 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T10:19:11.177 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{45EF83C7-DECC-4230-F650-EE0E8F919104}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 10:19:11
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T10:19:11.693 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:23:27.021 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 28303, Count: 1199, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: explorer.exe, Pid: 6304, TotalTime: 26070, Count: 544, MaxTime: 1265, MaxTimeFile: \Device\HarddiskVolume2\win-acme\wacs.exe, EstimatedImpact: 2%
2026-08-01T10:23:27.021 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 18894, Count: 706, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 15388, Count: 844, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 4666, Count: 7140, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24a6-0.MAI, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: powershell.exe, Pid: 6020, TotalTime: 2069, Count: 106, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 39%
2026-08-01T10:23:27.021 ProcessImageName: explorer.exe, Pid: 9156, TotalTime: 1728, Count: 84, MaxTime: 343, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1287, Count: 56, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: RuntimeBroker.exe, Pid: 2172, TotalTime: 1216, Count: 10, MaxTime: 375, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Migration\MEMigrate.exe, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: AgentShellService.exe, Pid: 1376, TotalTime: 1073, Count: 20, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 61%
2026-08-01T10:23:27.021 ProcessImageName: WmiPrvSE.exe, Pid: 5216, TotalTime: 1001, Count: 26, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 7%
2026-08-01T10:23:27.021 ProcessImageName: AgentShellSystemTray.exe, Pid: 6124, TotalTime: 990, Count: 40, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 28%
2026-08-01T10:23:27.021 ProcessImageName: explorer.exe, Pid: 7912, TotalTime: 980, Count: 49, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\SSL.txt.lnk, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: sdiagnhost.exe, Pid: 7540, TotalTime: 790, Count: 30, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad78daf4#\5c9dd78ce79da42d2defa70b5dd1fdfc\Microsoft.Windows.Diagnosis.SDHost.ni.dll, EstimatedImpact: 26%
2026-08-01T10:23:27.021 ProcessImageName: WmiPrvSE.exe, Pid: 1116, TotalTime: 685, Count: 39, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 51%
2026-08-01T10:23:27.021 ProcessImageName: mmc.exe, Pid: 6276, TotalTime: 567, Count: 29, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\MMCEx\f47c37b958419138e250638e2059ed08\MMCEx.ni.dll, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: wacs.exe, Pid: 5856, TotalTime: 564, Count: 28, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\win-acme\acme-v02.api.letsencrypt.org\public_suffix_list.dat, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: runonce.exe, Pid: 3304, TotalTime: 556, Count: 14, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 29%
2026-08-01T10:23:27.021 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 385, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_c9dc6fe1ea5611d7\Amd64\MSAppMon.xml, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: explorer.exe, Pid: 5596, TotalTime: 385, Count: 13, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemResources\accessibilitycpl.dll.mun, EstimatedImpact: 71%
2026-08-01T10:23:27.021 ProcessImageName: WmiPrvSE.exe, Pid: 8536, TotalTime: 372, Count: 6, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\win32kbase.sys, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 351, Count: 18, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: taskhostw.exe, Pid: 7488, TotalTime: 337, Count: 16, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\SDIAG_b9bdefc9-5d1a-4ffd-ae40-4f9a21ff33f7\DiagPackage.diagpkg, EstimatedImpact: 67%
2026-08-01T10:23:27.021 ProcessImageName: python.exe, Pid: 7840, TotalTime: 321, Count: 15, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 10%
2026-08-01T10:23:27.021 ProcessImageName: powershell.exe, Pid: 6360, TotalTime: 294, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 26%
2026-08-01T10:23:27.021 ProcessImageName: dllhost.exe, Pid: 9168, TotalTime: 260, Count: 19, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 247, Count: 4, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: w3wp.exe, Pid: 2176, TotalTime: 242, Count: 36, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Aspnet.config, EstimatedImpact: 25%
2026-08-01T10:23:27.021 ProcessImageName: dllhost.exe, Pid: 7640, TotalTime: 241, Count: 19, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: ngentask.exe, Pid: 5544, TotalTime: 228, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 41%
2026-08-01T10:23:27.021 ProcessImageName: wacs.exe, Pid: 5992, TotalTime: 170, Count: 7, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\win-acme\acme-v02.api.letsencrypt.org\public_suffix_list.dat, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: ngentask.exe, Pid: 1124, TotalTime: 150, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-08-01T10:23:27.021 ProcessImageName: ngentask.exe, Pid: 1328, TotalTime: 135, Count: 15, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19%
2026-08-01T10:23:27.021 ProcessImageName: powershell.exe, Pid: 6488, TotalTime: 122, Count: 7, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1, EstimatedImpact: 16%
2026-08-01T10:23:27.021 ProcessImageName: svchost.exe, Pid: 1360, TotalTime: 122, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\prn0013.tmp, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: svchost.exe, Pid: 6088, TotalTime: 122, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator.cdpresource, EstimatedImpact: 2%
2026-08-01T10:23:27.021 ProcessImageName: svchost.exe, Pid: 8468, TotalTime: 122, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\msedgeedge_BITS_9152_838833772\BIT945A.tmp, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: ngentask.exe, Pid: 7164, TotalTime: 121, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 20%
2026-08-01T10:23:27.021 ProcessImageName: python.exe, Pid: 6856, TotalTime: 107, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Certbot\accounts\acme-v02.api.letsencrypt.org\directory\612050855f7c1a31bed06818996045ed\regr.json, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: taskhostw.exe, Pid: 5416, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 17%
2026-08-01T10:23:27.021 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 91, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: powershell.exe, Pid: 1856, TotalTime: 91, Count: 6, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp8EF5.tmp, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: powershell.exe, Pid: 7320, TotalTime: 77, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp7EA9.tmp, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: runonce.exe, Pid: 5452, TotalTime: 77, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\Caches\cversions.1.db, EstimatedImpact: 9%
2026-08-01T10:23:27.021 ProcessImageName: python.exe, Pid: 5308, TotalTime: 77, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\auth_handler.py, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: cmd.exe, Pid: 2608, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: taskhostw.exe, Pid: 8644, TotalTime: 76, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SYSTEM, EstimatedImpact: 1%
2026-08-01T10:23:27.021 ProcessImageName: OpenWith.exe, Pid: 6360, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemResources\Windows.UI.Immersive.dll.mun, EstimatedImpact: 30%
2026-08-01T10:23:27.021 ProcessImageName: DeviceCensus.exe, Pid: 2284, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 8%
2026-08-01T10:23:27.021 ProcessImageName: cmd.exe, Pid: 5632, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\dumpalldatabases.bat, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: cmd.exe, Pid: 5968, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog_all_db_backups.txt, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: mysqldump.exe, Pid: 7340, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: svchost.exe, Pid: 2532, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\DiagTrack\utc.allow.diffbase, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: AggregatorHost.exe, Pid: 4104, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0%
2026-08-01T10:23:27.021 ProcessImageName: DismHost.exe, Pid: 8056, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{c76cbcad-afc9-11eb-8234-000d3aa6d50e}.TM.blf, EstimatedImpact: 1%
2026-08-01T10:23:27.021 ProcessImageName: svchost.exe, Pid: 2888, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator\ActivitiesCache.db-shm, EstimatedImpact: 0%
2026-08-01T10:28:30.755 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:28:30.755 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:28:30.755 [Cloud] Queued cloud request.
2026-08-01T10:28:30.755 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:28:30.755 [Cloud] Dequeued cloud request.
2026-08-01T10:28:30.755 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T10:28:30.911 [Cloud] End of cloud request.
2026-08-01T10:28:31.411 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:31:37.427 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T10:34:18.130 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:34:18.130 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:34:18.130 [Cloud] Queued cloud request.
2026-08-01T10:34:18.130 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:34:18.130 [Cloud] Dequeued cloud request.
2026-08-01T10:34:18.130 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{4A2AA9B6-BDFD-5A99-9BEE-300589F8A3A5}
SignatureID:55744863128705
SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 10:34:22
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T10:34:25.396 [Cloud] End of cloud request.
2026-08-01T10:34:25.911 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:36:40.802 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:36:40.802 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:36:40.802 [Cloud] Queued cloud request.
2026-08-01T10:36:40.802 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:36:40.802 [Cloud] Dequeued cloud request.
2026-08-01T10:36:40.802 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T10:36:40.942 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1142642C-CED6-6E98-CE97-BC22C94E3760}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 10:36:40
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T10:36:41.442 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:38:47.505 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:38:47.505 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:38:47.505 [Cloud] Queued cloud request.
2026-08-01T10:38:47.505 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:38:47.505 [Cloud] Dequeued cloud request.
2026-08-01T10:38:47.505 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T10:38:47.708 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{EA99BEF7-1B2E-AB2B-E396-D4FC1CE0CDD3}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 10:38:47
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T10:38:48.208 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:46:42.427 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T10:47:07.036 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:47:07.036 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:47:07.036 [Cloud] Queued cloud request.
2026-08-01T10:47:07.036 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:47:07.036 [Cloud] Dequeued cloud request.
2026-08-01T10:47:07.036 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T10:47:07.224 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{454A4D2B-130A-CC70-FDF8-5CA5E635D638}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 10:47:07
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T10:47:07.724 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:51:01.770 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:51:01.770 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:51:01.770 [Cloud] Queued cloud request.
2026-08-01T10:51:01.770 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:51:01.770 [Cloud] Dequeued cloud request.
2026-08-01T10:51:01.770 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T10:51:01.958 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{900DCA44-2E0B-DF70-BF06-CE2C83BD3C1E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 10:51:01
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T10:51:02.458 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:54:25.630 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:54:25.630 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:54:25.630 [Cloud] Queued cloud request.
2026-08-01T10:54:25.630 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:54:25.630 [Cloud] Dequeued cloud request.
2026-08-01T10:54:25.630 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T10:54:25.801 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{DB4F933D-8D38-C887-5E0F-BF97792E4BFF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 10:54:25
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T10:54:26.301 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T10:55:14.270 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T10:55:14.270 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T10:55:14.270 [Cloud] Queued cloud request.
2026-08-01T10:55:14.270 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T10:55:14.270 [Cloud] Dequeued cloud request.
2026-08-01T10:55:14.270 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T10:55:14.348 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{569A27D5-0C76-3C70-99A5-90807AA8AC0F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 10:55:14
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T10:55:14.864 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T11:01:47.426 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T11:07:22.151 ReportLowfi(ctfmon.exe, 0x437a0835) from 0x0006b6bd6566d2d9
2026-08-01T11:07:23.837 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\PrsFCF4.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8123299, FileId: 0x1400000001b718, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T11:07:25.967 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\Prs571.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8123527, FileId: 0x1200000001b75a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T11:07:28.214 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\PrsE2D.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8123750, FileId: 0x1300000001b94c, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T11:08:16.215 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\70A3EE5D-4F1A-4DC4-AFB2-1127442822441df4.1dd21a60bbf1506
2026-08-01T11:08:16.274 Verifying engine and signature files (source: 0) ...
2026-08-01T11:08:16.274 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{42DE0106-9624-4064-822A-90FAC1C2161B}\mpengine.dll] due to PPL.
2026-08-01T11:08:16.274 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{42DE0106-9624-4064-822A-90FAC1C2161B}\mpasbase.vdm]. File not in cache (0x1)
2026-08-01T11:08:17.349 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{42DE0106-9624-4064-822A-90FAC1C2161B}\mpasbase.vdm]
2026-08-01T11:08:17.349 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{42DE0106-9624-4064-822A-90FAC1C2161B}\mpasdlta.vdm]. File not in cache (0x1)
2026-08-01T11:08:17.365 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{42DE0106-9624-4064-822A-90FAC1C2161B}\mpasdlta.vdm]
2026-08-01T11:08:17.365 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{42DE0106-9624-4064-822A-90FAC1C2161B}\mpavbase.vdm]. File not in cache (0x1)
2026-08-01T11:08:17.818 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{42DE0106-9624-4064-822A-90FAC1C2161B}\mpavbase.vdm]
2026-08-01T11:08:17.818 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{42DE0106-9624-4064-822A-90FAC1C2161B}\mpavdlta.vdm]. File not in cache (0x1)
2026-08-01T11:08:17.833 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{42DE0106-9624-4064-822A-90FAC1C2161B}\mpavdlta.vdm]
2026-08-01T11:08:18.021 [Engine] IsHybridMode: 0
2026-08-01T11:08:18.021 [KSL]KSL(1.1.26051.3007) Is available via CAMP. KslDevice : KslD
2026-08-01T11:08:18.036 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-FCCEB7E24A5429BD9685DA619D42000CFB547A65.bin): 0x00000002
2026-08-01T11:08:18.036 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-FCCEB7E24A5429BD9685DA619D42000CFB547A65.bin)
2026-08-01T11:08:18.036 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0
2026-08-01T11:08:18.036 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0
2026-08-01T11:08:18.036 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0
2026-08-01T11:08:18.036 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff
Internal signature match:subtype=Lowfi, sigseq=0x000082E7F0901A0A, sigsha=7902eb5d39888eb083c7611e8a99d25d9c960c3b, cached=false, source=0, resourceid=0xac395ff7
2026-08-01T11:08:23.664 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T11:08:23.664 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T11:08:23.664 [Cloud] Queued cloud request.
2026-08-01T11:08:23.664 [Cloud] Dequeued cloud request.
2026-08-01T11:08:23.664 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T11:08:23.679 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\19a139bfb88a910a46f3c618589b379376a9f735
Dynamic Signature Compilation Timestamp:08-01-2026 11:08:24
Persistence Type:Duration
Time remaining:150196224
2026-08-01T11:08:24.148 Dynamic signature received
2026-08-01T11:08:24.149 RTSD:RTSD recieved, rescanning impacted resources
2026-08-01T11:08:24.150 [Cloud] End of cloud request.
2026-08-01T11:08:24.663 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b
IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b
IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b
IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b
IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d
IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b
IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d
IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b
2026-08-01T11:08:36.201 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
2026-08-01T11:08:36.201 [AutoExclusion] Applied roles from cache.
2026-08-01T11:08:36.201 [AutoExclusion] Started roles monitoring.
IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b
IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4
IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b
IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4
IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4
IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b
IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b
IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b
IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b
IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpFc_Kernel_DoNotResetExcludeOnModify hr=0x8007007b
IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse
IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0
IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse
2026-08-01T11:08:36.295 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFA3A758AF0, lRefCount: 6, hr=0
2026-08-01T11:08:36.295 [Engine] New active engine 00007FFA16978AF0 replacing engine 00007FFA3A758AF0. Number of active engines: 2
2026-08-01T11:08:36.311 EngineInit:Global ASOC is enabled
2026-08-01T11:08:36.311 EngineInit:ASOO is enabled for developer volumes
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T11:08:36.373 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T11:08:36.389 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T11:08:36.389 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T11:08:36.389 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T11:08:36.404 MpWriteUupSignatureVersion 1.455.452.0, hr = 0
2026-08-01T11:08:36.404 ForceSyncMoacInsertion config from engine is 0, hr = 0x0
2026-08-01T11:08:36.420 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit
2026-08-01T11:08:36.436 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0
2026-08-01T11:08:36.436 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)!
2026-08-01T11:08:36.436 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set.
2026-08-01T11:08:36.451 MpUpdateUpdateResiliencyConfiguration updated to 0
2026-08-01T11:08:36.451 [Plugin] Initializing RTP plugin state...
2026-08-01T11:08:36.451 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off.
2026-08-01T11:08:36.451 [RTP] 
****************************RTP Perf Log***************************
RTP Start:‎07‎-‎31‎-‎2026 16:23:27
Last Perf:‎07‎-‎31‎-‎2026 16:23:27
First RTP Scan:‎07‎-‎31‎-‎2026 16:23:27
Plugin States:  AV:1  AS:1  RTP:1  OA:1  BM:1
Process Exclusions:
Path Exclusions:
Ext Exclusions:
Temp Exclusions:
Worker Threads:
  AM:14
  Async:4
Cache Flushes:
  RTP:1
System File Cache:
  Hits:2109
  Misses:21626
BM Queue:0,700,0
  Proc:0,699,0
  File:0,361,0
Plugin Queue:0,1,0
  Threat:0,0,0
  Susp:0,1,0
  Unknown:0,0,0
  Error:0,0,0
Request Queue:1,3,0
  SetEngine:1,1,0
  SetState:0,1,0
  SetUser:0,1,0
  Config:0,1,0
  ProcExcl:0,1,0
  FilterReload:0,0,0
  FilterUnload:0,0,0
MpFilter:
  Scans:8124373
  Pending:0
  RegSize:309472
  AsyncQNotif:0
  AsyncQMissed:0
  AsyncQTotalSent:996565194
  AsyncQCurrent:0
  BMFlags:40095
  ServiceMaj:0
  ServiceMin:0
  NumInstance:3
  TotalStreamCon:14875
  NTFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:493256
   TotalHits:3123840
   InstanceCacheInserts:9978
   InstanceCacheUpdates:0
   InstanceCacheDeletes:7524
   InstanceCacheHits:1812
   InstanceCacheMisses:141436
   InstanceCacheOverflows:0
  CSVFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:0
   TotalHits:0
   InstanceCacheInserts:0
   InstanceCacheUpdates:0
   InstanceCacheDeletes:0
   InstanceCacheHits:0
   InstanceCacheMisses:0
   InstanceCacheOverflows:0
  REFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:0
   TotalHits:0
   InstanceCacheInserts:0
   InstanceCacheUpdates:0
   InstanceCacheDeletes:0
   InstanceCacheHits:0
   InstanceCacheMisses:0
   InstanceCacheOverflows:0
  SyncProcessCreateDuration:6ms (10329/1685)
   Success: 1685, failures: 0 (last code: 0x0), timeouts: 0,  baddata: 0
 
**************************END RTP Perf Log*************************

 
 

2026-08-01T11:08:36.451 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{42DE0106-9624-4064-822A-90FAC1C2161B}
2026-08-01T11:08:36.451 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B786FD71-C5AC-4647-90B0-905FDBDB3F32}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B786FD71-C5AC-4647-90B0-905FDBDB3F32}\mpasbase.vdm in use, hr=0x80070020
2026-08-01T11:08:36.451 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FB31D9BD-CDF4-4C06-A7B4-CF2B78FBA061} removed
2026-08-01T11:08:36.451 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0).
2026-08-01T11:08:36.451 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f
2026-08-01T11:08:36.451 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f
2026-08-01T11:08:36.451 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f
2026-08-01T11:08:36.451 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f
2026-08-01T11:08:36.451 MdCoreSvc is supported in this platform and OS
Beginning quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Target:
Flags:131074
Start time:08-01-2026 11:08:36
Finished quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Result:0
End time:08-01-2026 11:08:36
2026-08-01T11:08:36.467 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-01T11:08:36.467 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0).
BmLoggingDisabled:MpDisableBmLogging not set.
2026-08-01T11:08:36.467 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0
2026-08-01T11:08:36.467 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0
2026-08-01T11:08:36.467 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T11:08:36.467 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f
2026-08-01T11:08:36.467 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f
2026-08-01T11:08:36.467 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f
2026-08-01T11:08:36.467 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f
2026-08-01T11:08:36.467 MdCoreSvc is supported in this platform and OS
Signature updated on 08-01-2026 11:08:36
Product Version: 4.18.26060.3008
Service Version: 4.18.26060.3008
Engine Version: 1.1.26060.3008
AS Signature Version: 1.455.452.0
AV Signature Version: 1.455.452.0
************************************************************
2026-08-01T11:08:36.482 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0
2026-08-01T11:08:36.482 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\70A3EE5D-4F1A-4DC4-AFB2-1127442822441df4.1dd21a60bbf1506
2026-08-01T11:08:36.514 Process scan (postsignatureupdatescan) started.
2026-08-01T11:08:36.529 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True
2026-08-01T11:08:36.529 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0
2026-08-01T11:08:36.904 [RTP] Setting RegLinkHardeningMode to 1 (hr=0).
2026-08-01T11:08:36.904 [RTP] Setting EfsHardeningFlags to 0 (hr=0).
2026-08-01T11:08:36.904 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0).
2026-08-01T11:08:36.904 [RTP] PreventPagingFileAbuseKillbit[0].
2026-08-01T11:08:36.904 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0).
2026-08-01T11:08:36.904 [Engine] Engine 00007FFA3A758AF0 no longer in use. Number of active engines: 1
2026-08-01T11:08:36.904 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-01T11:08:36.904 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0).
2026-08-01T11:08:36.936 [KSL] Entering CKSLEngine::EnableKSL. State: [3]
2026-08-01T11:08:36.936 [KSL] CKSLEngine::EnableKSL feature is already enabled.
2026-08-01T11:08:36.936 [KSL] Leaving CKSLEngine::EnableKsl(0).
2026-08-01T11:08:37.619 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 29723, Count: 1270, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-08-01T11:08:37.619 ProcessImageName: explorer.exe, Pid: 6304, TotalTime: 26070, Count: 544, MaxTime: 1265, MaxTimeFile: \Device\HarddiskVolume2\win-acme\wacs.exe, EstimatedImpact: 2%
2026-08-01T11:08:37.619 ProcessImageName: AgentShell.exe, Pid: 868, TotalTime: 18894, Count: 706, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-01T11:08:37.619 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 15604, Count: 852, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0%
2026-08-01T11:08:37.619 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 4666, Count: 7140, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-24a6-0.MAI, EstimatedImpact: 0%
2026-08-01T11:08:37.619 ProcessImageName: powershell.exe, Pid: 6020, TotalTime: 2069, Count: 106, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 39%
2026-08-01T11:08:37.619 ProcessImageName: explorer.exe, Pid: 9156, TotalTime: 1728, Count: 84, MaxTime: 343, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-01T11:08:37.619 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1333, Count: 58, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-01T11:08:37.619 ProcessImageName: RuntimeBroker.exe, Pid: 2172, TotalTime: 1216, Count: 10, MaxTime: 375, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Migration\MEMigrate.exe, EstimatedImpact: 0%
2026-08-01T11:08:37.619 ProcessImageName: AgentShellService.exe, Pid: 1376, TotalTime: 1073, Count: 20, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 61%
2026-08-01T11:08:37.619 ProcessImageName: WmiPrvSE.exe, Pid: 5216, TotalTime: 1001, Count: 26, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 7%
2026-08-01T11:08:37.619 ProcessImageName: AgentShellSystemTray.exe, Pid: 6124, TotalTime: 990, Count: 40, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 28%
2026-08-01T11:08:37.619 ProcessImageName: explorer.exe, Pid: 7912, TotalTime: 980, Count: 49, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\SSL.txt.lnk, EstimatedImpact: 0%
2026-08-01T11:08:37.619 ProcessImageName: sdiagnhost.exe, Pid: 7540, TotalTime: 790, Count: 30, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad78daf4#\5c9dd78ce79da42d2defa70b5dd1fdfc\Microsoft.Windows.Diagnosis.SDHost.ni.dll, EstimatedImpact: 26%
2026-08-01T11:08:37.619 ProcessImageName: WmiPrvSE.exe, Pid: 1116, TotalTime: 685, Count: 39, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 51%
2026-08-01T11:08:37.733 [Engine] RSIG_UNLOADENGINE, 00007FFA3A758AF0, err=0x0
2026-08-01T11:08:37.764 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B786FD71-C5AC-4647-90B0-905FDBDB3F32} removed
2026-08-01T11:08:53.764 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T11:08:53.764 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T11:08:53.764 [Cloud] Queued cloud request.
2026-08-01T11:08:53.764 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T11:08:53.764 [Cloud] Dequeued cloud request.
2026-08-01T11:08:53.764 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T11:08:53.842 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9F60C42F-6AA4-69FA-A42C-D13597686B7A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 11:08:53
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T11:08:54.373 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T11:09:00.680 Process scan (postsignatureupdatescan) completed.
2026-08-01T11:12:06.498 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\ProgramData\USOShared\Logs\User\UpdateUx.53eb0a97-ef99-4665-bc02-79abd73b9770.1.etl. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8125878, FileId: 0xb000000006397, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x2000, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T11:13:36.357 [RbM] Setting Last known good engine candidate. hr = 0
2026-08-01T11:16:52.420 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T11:18:11.748 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T11:18:11.748 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T11:18:11.748 [Cloud] Queued cloud request.
2026-08-01T11:18:11.748 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T11:18:11.748 [Cloud] Dequeued cloud request.
2026-08-01T11:18:11.748 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T11:18:11.935 [Cloud] End of cloud request.
2026-08-01T11:18:12.451 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T11:19:30.420 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T11:19:30.420 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T11:19:30.420 [Cloud] Queued cloud request.
2026-08-01T11:19:30.420 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T11:19:30.420 [Cloud] Dequeued cloud request.
2026-08-01T11:19:30.420 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T11:19:30.623 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4CABDCB5-07CC-0C84-068E-71A993A94EBA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 11:19:30
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T11:19:31.123 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T11:30:16.435 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T11:30:16.435 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T11:30:16.435 [Cloud] Queued cloud request.
2026-08-01T11:30:16.435 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T11:30:16.435 [Cloud] Dequeued cloud request.
2026-08-01T11:30:16.435 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T11:30:16.623 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F6C7E6E8-22EB-7F1E-A618-4BC9C3E1F7E3}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 11:30:16
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T11:30:17.123 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T11:31:57.419 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T11:34:11.872 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T11:34:11.872 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T11:34:11.872 [Cloud] Queued cloud request.
2026-08-01T11:34:11.872 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T11:34:11.872 [Cloud] Dequeued cloud request.
2026-08-01T11:34:11.872 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T11:34:12.060 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{98E47406-92B7-B6EE-8E52-56FC614C53A2}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 11:34:12
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T11:34:12.560 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T11:40:46.803 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\logs\error.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8135935, FileId: 0x100000008005c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T11:42:36.247 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\logs\error.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8136594, FileId: 0x100000008005c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T11:47:02.419 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T12:01:56.513 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\logs\error.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8145193, FileId: 0x100000008005c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T12:02:07.419 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T12:03:49.450 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T12:03:49.450 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T12:03:49.450 [Cloud] Queued cloud request.
2026-08-01T12:03:49.450 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T12:03:49.450 [Cloud] Dequeued cloud request.
2026-08-01T12:03:49.450 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T12:03:49.653 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{A0A3CF7A-23DE-36FF-3D91-7AF3977CABC3}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 12:03:49
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T12:03:50.153 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T12:04:25.356 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\nginx\logs\error.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8146190, FileId: 0x1400000002f521, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x101, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T12:04:25.450 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8146193, FileId: 0x900000000fddf, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T12:11:05.700 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T12:11:05.700 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T12:11:05.700 [Cloud] Queued cloud request.
2026-08-01T12:11:05.700 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T12:11:05.700 [Cloud] Dequeued cloud request.
2026-08-01T12:11:05.700 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T12:11:05.887 [Cloud] End of cloud request.
2026-08-01T12:11:06.387 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T12:17:12.418 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T12:28:24.230 ReportLowfi(ctfmon.exe, 0x437a0835) from 0x0006b6bd6566d2d9
2026-08-01T12:28:25.519 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\Prs2B11.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8154956, FileId: 0x21000000035bbc, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T12:28:26.356 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\Prs2F48.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8155188, FileId: 0x1d000000035e9e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T12:28:30.449 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\Prs3F57.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8155587, FileId: 0x200000000362d8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T12:32:17.418 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T12:42:02.152 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8161514, FileId: 0x7000000010386, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T12:47:22.418 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T13:02:27.417 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T13:08:36.292 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 3783, Count: 191, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: explorer.exe, Pid: 5728, TotalTime: 3595, Count: 181, MaxTime: 609, MaxTimeFile: \Device\HarddiskVolume2\nginx-1.30.4\nginx.exe, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: explorer.exe, Pid: 7300, TotalTime: 2013, Count: 93, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: httpd.exe, Pid: 4916, TotalTime: 1137, Count: 52, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: httpd.exe, Pid: 2524, TotalTime: 971, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\PHP53\ext\ioncube_loader_win_5.3.dll, EstimatedImpact: 1%
2026-08-01T13:08:36.292 ProcessImageName: AgentShellSystemTray.exe, Pid: 4568, TotalTime: 865, Count: 34, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 33%
2026-08-01T13:08:36.292 ProcessImageName: httpd.exe, Pid: 2504, TotalTime: 602, Count: 15, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php5ts.dll, EstimatedImpact: 71%
2026-08-01T13:08:36.292 ProcessImageName: runonce.exe, Pid: 1124, TotalTime: 463, Count: 14, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 33%
2026-08-01T13:08:36.292 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 398, Count: 24, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: explorer.exe, Pid: 8748, TotalTime: 350, Count: 18, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\Q7VyR5JwnYyTyoAb3tRqkuN3mazyu0AkuFYvemYtzw4.lnk, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: httpd.exe, Pid: 892, TotalTime: 318, Count: 19, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\header.php, EstimatedImpact: 65%
2026-08-01T13:08:36.292 ProcessImageName: httpd.exe, Pid: 6536, TotalTime: 246, Count: 8, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\admin.php, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: dllhost.exe, Pid: 1516, TotalTime: 243, Count: 16, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: dllhost.exe, Pid: 2144, TotalTime: 212, Count: 21, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: python.exe, Pid: 6936, TotalTime: 106, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 9%
2026-08-01T13:08:36.292 ProcessImageName: httpd.exe, Pid: 4700, TotalTime: 106, Count: 6, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\index.html, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: python.exe, Pid: 1972, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\auth_handler.py, EstimatedImpact: 13%
2026-08-01T13:08:36.292 ProcessImageName: httpd.exe, Pid: 3452, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\httpd.conf, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: nginx.exe, Pid: 6400, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\nginx\logs\access.log, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: svchost.exe, Pid: 5480, TotalTime: 76, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator\ActivitiesCache.db-shm, EstimatedImpact: 1%
2026-08-01T13:08:36.292 ProcessImageName: httpd.exe, Pid: 8944, TotalTime: 61, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\httpd.conf, EstimatedImpact: 18%
2026-08-01T13:08:36.292 ProcessImageName: notepad.exe, Pid: 1196, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\extra\httpd-vhosts.conf, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: python.exe, Pid: 1904, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Certbot\accounts\acme-v02.api.letsencrypt.org\directory\612050855f7c1a31bed06818996045ed\regr.json, EstimatedImpact: 11%
2026-08-01T13:08:36.292 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-01T13:08:36.292 ProcessImageName: svchost.exe, Pid: 1360, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\prn0033.tmp, EstimatedImpact: 0%
2026-08-01T13:17:32.417 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T13:32:37.417 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T13:47:42.416 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T14:02:47.416 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T14:04:17.541 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T14:04:17.541 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T14:04:17.541 [Cloud] Queued cloud request.
2026-08-01T14:04:17.541 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T14:04:17.541 [Cloud] Dequeued cloud request.
2026-08-01T14:04:17.541 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T14:04:17.744 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{D9C50628-252D-9D6A-D05C-50873C426AC6}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 14:04:17
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T14:04:18.244 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T14:04:40.728 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T14:04:40.728 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T14:04:40.728 [Cloud] Queued cloud request.
2026-08-01T14:04:40.728 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T14:04:40.885 [Cloud] Dequeued cloud request.
2026-08-01T14:04:40.885 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T14:04:40.963 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F8F01340-CD41-F77E-3555-D0FE014E504A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 14:04:40
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T14:04:41.463 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T14:07:39.806 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T14:07:39.806 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T14:07:39.806 [Cloud] Queued cloud request.
2026-08-01T14:07:39.806 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T14:07:39.806 [Cloud] Dequeued cloud request.
2026-08-01T14:07:39.806 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T14:07:39.994 [Cloud] End of cloud request.
2026-08-01T14:07:40.509 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T14:12:09.259 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T14:12:09.259 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T14:12:09.259 [Cloud] Queued cloud request.
2026-08-01T14:12:09.259 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T14:12:09.259 [Cloud] Dequeued cloud request.
2026-08-01T14:12:09.259 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T14:12:09.447 [Cloud] End of cloud request.
2026-08-01T14:12:09.947 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T14:12:48.025 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T14:12:48.025 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T14:12:48.025 [Cloud] Queued cloud request.
2026-08-01T14:12:48.025 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T14:12:48.025 [Cloud] Dequeued cloud request.
2026-08-01T14:12:48.025 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T14:12:48.103 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{99AD45CA-AAC1-A5EF-E643-70CF0DDE5C58}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 14:12:48
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T14:12:48.619 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T14:13:08.462 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T14:13:08.462 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T14:13:08.462 [Cloud] Queued cloud request.
2026-08-01T14:13:08.462 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T14:13:08.462 [Cloud] Dequeued cloud request.
2026-08-01T14:13:08.462 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T14:13:08.541 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{93A53876-B721-0DAF-6E58-56F099E553B0}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 14:13:08
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T14:13:09.041 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T14:17:52.415 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T14:20:47.431 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T14:20:47.431 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T14:20:47.431 [Cloud] Queued cloud request.
2026-08-01T14:20:47.431 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T14:20:47.431 [Cloud] Dequeued cloud request.
2026-08-01T14:20:47.431 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T14:20:47.587 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{A4688819-2C70-7224-5637-926A7DDF7191}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 14:20:47
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T14:20:48.087 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T14:22:37.415 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3
2026-08-01T14:22:37.447 Job Notification: New process added to job (1192)
2026-08-01T14:22:37.462 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched
2026-08-01T14:22:37.462 Aggressive catchup quick scan threshold: 489526333258 / 25920000000000
2026-08-01T14:22:37.462 Job Notification: New process added to job (7156)
2026-08-01T14:22:37.478 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26060.3008-0\MpCmdRun.exe][Pid:1192] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7156]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4]
2026-08-01T14:22:37.603 Job Notification: New process added to job (2616)
2026-08-01T14:22:37.603 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched
2026-08-01T14:22:37.603 Job Notification: New process added to job (9164)
2026-08-01T14:22:37.619 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26060.3008-0\MpCmdRun.exe][Pid:2616] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:9164]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4]
2026-08-01T14:22:37.978 [RTP] [RtpConfig] Config change detected, type: 32
2026-08-01T14:22:37.978 [RTP] Duplicating the current plugin configuration object...
2026-08-01T14:22:37.978 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ...
2026-08-01T14:22:37.978 [RTP] Updating plugin configuration due to recent config changes (0x20) ...
2026-08-01T14:22:37.978 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-01T14:22:37.978 [RTP] No config change detected. Not updating plugin configuration.
2026-08-01T14:22:37.978 [RTP] No config changes found. No configuration switch.
2026-08-01T14:22:37.978 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0
2026-08-01T14:22:53.181 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\919FAF47-10D9-43D6-8A45-D8CD48237D1A19b0.1dd21c13bef32fd
2026-08-01T14:22:53.244 Verifying engine and signature files (source: 0) ...
2026-08-01T14:22:53.244 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9EFD095A-7991-4B04-8A83-1BECCAAF06CF}\mpengine.dll] due to PPL.
2026-08-01T14:22:53.244 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9EFD095A-7991-4B04-8A83-1BECCAAF06CF}\mpasbase.vdm] (file in cache)
2026-08-01T14:22:53.244 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9EFD095A-7991-4B04-8A83-1BECCAAF06CF}\mpasdlta.vdm]. File not in cache (0x1)
2026-08-01T14:22:53.259 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9EFD095A-7991-4B04-8A83-1BECCAAF06CF}\mpasdlta.vdm]
2026-08-01T14:22:53.259 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9EFD095A-7991-4B04-8A83-1BECCAAF06CF}\mpavbase.vdm] (file in cache)
2026-08-01T14:22:53.259 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9EFD095A-7991-4B04-8A83-1BECCAAF06CF}\mpavdlta.vdm]. File not in cache (0x1)
2026-08-01T14:22:53.275 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9EFD095A-7991-4B04-8A83-1BECCAAF06CF}\mpavdlta.vdm]
2026-08-01T14:22:53.462 [Engine] IsHybridMode: 0
2026-08-01T14:22:53.462 [KSL]KSL(1.1.26051.3007) Is available via CAMP. KslDevice : KslD
2026-08-01T14:22:53.478 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-4DC9722DE42963C8A3D8DDC7594AAD709338D8F6.bin): 0x00000002
2026-08-01T14:22:53.478 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-4DC9722DE42963C8A3D8DDC7594AAD709338D8F6.bin)
2026-08-01T14:22:53.478 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0
2026-08-01T14:22:53.478 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0
2026-08-01T14:22:53.478 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0
2026-08-01T14:22:53.478 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff
IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b
IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b
IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b
IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b
IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d
IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b
IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d
IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b
2026-08-01T14:23:06.509 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
2026-08-01T14:23:06.509 [AutoExclusion] Applied roles from cache.
2026-08-01T14:23:06.509 [AutoExclusion] Started roles monitoring.
IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b
IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4
IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b
IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4
IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4
IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b
IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b
IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b
IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b
IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4
IDynamicConfig::ReportError ECS value=MpFc_Kernel_DoNotResetExcludeOnModify hr=0x8007007b
IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse
IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0
IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse
2026-08-01T14:23:06.634 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFA16978AF0, lRefCount: 6, hr=0
2026-08-01T14:23:06.634 [Engine] New active engine 00007FFA3A7F8AF0 replacing engine 00007FFA16978AF0. Number of active engines: 2
2026-08-01T14:23:06.650 EngineInit:Global ASOC is enabled
2026-08-01T14:23:06.650 EngineInit:ASOO is enabled for developer volumes
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T14:23:06.697 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-01T14:23:06.728 MpWriteUupSignatureVersion 1.455.456.0, hr = 0
2026-08-01T14:23:06.728 ForceSyncMoacInsertion config from engine is 0, hr = 0x0
2026-08-01T14:23:06.744 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit
2026-08-01T14:23:06.759 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0
2026-08-01T14:23:06.759 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)!
2026-08-01T14:23:06.759 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set.
2026-08-01T14:23:06.775 MpUpdateUpdateResiliencyConfiguration updated to 0
2026-08-01T14:23:06.775 [Plugin] Initializing RTP plugin state...
2026-08-01T14:23:06.775 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off.
2026-08-01T14:23:06.775 [RTP] 
****************************RTP Perf Log***************************
RTP Start:‎08‎-‎01‎-‎2026 13:08:36
Last Perf:‎08‎-‎01‎-‎2026 13:08:36
First RTP Scan:‎08‎-‎01‎-‎2026 13:08:37
Plugin States:  AV:1  AS:1  RTP:1  OA:1  BM:1
Process Exclusions:
Path Exclusions:
Ext Exclusions:
Temp Exclusions:
Worker Threads:
  AM:14
  Async:4
Cache Flushes:
  RTP:1
System File Cache:
  Hits:1081
  Misses:6151
BM Queue:0,1220,0
  Proc:0,1211,0
  File:0,440,0
Plugin Queue:0,1,0
  Threat:0,0,0
  Susp:0,1,0
  Unknown:0,0,0
  Error:0,0,0
Request Queue:1,3,0
  SetEngine:1,1,0
  SetState:0,1,0
  SetUser:0,1,0
  Config:0,1,0
  ProcExcl:0,1,0
  FilterReload:0,0,0
  FilterUnload:0,0,0
MpFilter:
  Scans:8195382
  Pending:0
  RegSize:309472
  AsyncQNotif:0
  AsyncQMissed:0
  AsyncQTotalSent:1024448392
  AsyncQCurrent:0
  BMFlags:40127
  ServiceMaj:0
  ServiceMin:0
  NumInstance:3
  TotalStreamCon:13904
  NTFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:503753
   TotalHits:3177249
   InstanceCacheInserts:10438
   InstanceCacheUpdates:0
   InstanceCacheDeletes:8167
   InstanceCacheHits:1998
   InstanceCacheMisses:150153
   InstanceCacheOverflows:0
  CSVFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:0
   TotalHits:0
   InstanceCacheInserts:0
   InstanceCacheUpdates:0
   InstanceCacheDeletes:0
   InstanceCacheHits:0
   InstanceCacheMisses:0
   InstanceCacheOverflows:0
  REFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:0
   TotalHits:0
   InstanceCacheInserts:0
   InstanceCacheUpdates:0
   InstanceCacheDeletes:0
   InstanceCacheHits:0
   InstanceCacheMisses:0
   InstanceCacheOverflows:0
  SyncProcessCreateDuration:5ms (2298/410)
   Success: 410, failures: 0 (last code: 0x0), timeouts: 0,  baddata: 0
 
**************************END RTP Perf Log*************************

 
 

2026-08-01T14:23:06.775 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9EFD095A-7991-4B04-8A83-1BECCAAF06CF}
2026-08-01T14:23:06.775 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{18E6A68D-6F05-4E20-AC04-896739D89942} removed
2026-08-01T14:23:06.775 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{42DE0106-9624-4064-822A-90FAC1C2161B}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{42DE0106-9624-4064-822A-90FAC1C2161B}\mpasbase.vdm in use, hr=0x80070020
2026-08-01T14:23:06.775 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f
2026-08-01T14:23:06.775 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f
2026-08-01T14:23:06.775 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f
2026-08-01T14:23:06.775 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f
2026-08-01T14:23:06.775 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0).
2026-08-01T14:23:06.775 MdCoreSvc is supported in this platform and OS
Beginning quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Target:
Flags:131074
Start time:08-01-2026 14:23:06
Finished quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Result:0
End time:08-01-2026 14:23:06
2026-08-01T14:23:06.775 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0
2026-08-01T14:23:06.775 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0
2026-08-01T14:23:06.790 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-01T14:23:06.790 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0).
BmLoggingDisabled:MpDisableBmLogging not set.
2026-08-01T14:23:06.790 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T14:23:06.790 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f
2026-08-01T14:23:06.790 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f
2026-08-01T14:23:06.790 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f
2026-08-01T14:23:06.790 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f
2026-08-01T14:23:06.790 MdCoreSvc is supported in this platform and OS
Signature updated on 08-01-2026 14:23:06
Product Version: 4.18.26060.3008
Service Version: 4.18.26060.3008
Engine Version: 1.1.26060.3008
AS Signature Version: 1.455.456.0
AV Signature Version: 1.455.456.0
************************************************************
2026-08-01T14:23:06.790 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0
2026-08-01T14:23:06.790 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\919FAF47-10D9-43D6-8A45-D8CD48237D1A19b0.1dd21c13bef32fd
2026-08-01T14:23:06.806 Process scan (postsignatureupdatescan) started.
2026-08-01T14:23:06.853 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True
2026-08-01T14:23:06.869 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0
Signature updated via MicrosoftUpdateServer on 08-01-2026 14:23:06
************************************************************
2026-08-01T14:23:06.962 Job Notification: Process exited from job (2616)
2026-08-01T14:23:06.962 Job Notification: Process exited from job (9164)
2026-08-01T14:23:07.009 Job Notification: Process exited from job (1192)
2026-08-01T14:23:07.009 Job Notification: Process exited from job (7156)
2026-08-01T14:23:07.165 [RTP] Setting RegLinkHardeningMode to 1 (hr=0).
2026-08-01T14:23:07.165 [RTP] Setting EfsHardeningFlags to 0 (hr=0).
2026-08-01T14:23:07.165 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0).
2026-08-01T14:23:07.165 [RTP] PreventPagingFileAbuseKillbit[0].
2026-08-01T14:23:07.165 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0).
2026-08-01T14:23:07.165 [Engine] Engine 00007FFA16978AF0 no longer in use. Number of active engines: 1
2026-08-01T14:23:07.165 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-01T14:23:07.165 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0).
2026-08-01T14:23:07.244 [KSL] Entering CKSLEngine::EnableKSL. State: [3]
2026-08-01T14:23:07.244 [KSL] CKSLEngine::EnableKSL feature is already enabled.
2026-08-01T14:23:07.244 [KSL] Leaving CKSLEngine::EnableKsl(0).
2026-08-01T14:23:07.634 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 6284, Count: 307, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\config.json, EstimatedImpact: 0%
2026-08-01T14:23:07.634 ProcessImageName: httpd.exe, Pid: 4916, TotalTime: 4773, Count: 236, MaxTime: 421, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0%
2026-08-01T14:23:07.634 ProcessImageName: explorer.exe, Pid: 5728, TotalTime: 3595, Count: 181, MaxTime: 609, MaxTimeFile: \Device\HarddiskVolume2\nginx-1.30.4\nginx.exe, EstimatedImpact: 0%
2026-08-01T14:23:07.634 ProcessImageName: explorer.exe, Pid: 7300, TotalTime: 2013, Count: 93, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-01T14:23:07.634 ProcessImageName: httpd.exe, Pid: 2524, TotalTime: 971, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\PHP53\ext\ioncube_loader_win_5.3.dll, EstimatedImpact: 1%
2026-08-01T14:23:07.634 ProcessImageName: AgentShellSystemTray.exe, Pid: 4568, TotalTime: 865, Count: 34, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 33%
2026-08-01T14:23:07.634 ProcessImageName: httpd.exe, Pid: 2504, TotalTime: 602, Count: 15, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php5ts.dll, EstimatedImpact: 71%
2026-08-01T14:23:07.634 ProcessImageName: runonce.exe, Pid: 1124, TotalTime: 463, Count: 14, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 33%
2026-08-01T14:23:07.634 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 398, Count: 24, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 0%
2026-08-01T14:23:07.634 ProcessImageName: explorer.exe, Pid: 8748, TotalTime: 350, Count: 18, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\Q7VyR5JwnYyTyoAb3tRqkuN3mazyu0AkuFYvemYtzw4.lnk, EstimatedImpact: 0%
2026-08-01T14:23:07.634 ProcessImageName: httpd.exe, Pid: 892, TotalTime: 318, Count: 19, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\header.php, EstimatedImpact: 65%
2026-08-01T14:23:07.634 ProcessImageName: httpd.exe, Pid: 6536, TotalTime: 246, Count: 8, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\admin.php, EstimatedImpact: 0%
2026-08-01T14:23:07.634 ProcessImageName: dllhost.exe, Pid: 1516, TotalTime: 243, Count: 16, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk, EstimatedImpact: 0%
2026-08-01T14:23:07.634 ProcessImageName: dllhost.exe, Pid: 2144, TotalTime: 212, Count: 21, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk, EstimatedImpact: 0%
2026-08-01T14:23:07.634 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 198, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0%
2026-08-01T14:23:07.634 ProcessImageName: python.exe, Pid: 6936, TotalTime: 106, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 9%
2026-08-01T14:23:07.704 [Engine] RSIG_UNLOADENGINE, 00007FFA16978AF0, err=0x0
2026-08-01T14:23:07.728 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{42DE0106-9624-4064-822A-90FAC1C2161B} removed
2026-08-01T14:23:25.040 Process scan (postsignatureupdatescan) completed.
2026-08-01T14:27:27.509 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T14:27:27.509 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T14:27:27.509 [Cloud] Queued cloud request.
2026-08-01T14:27:27.509 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T14:27:27.509 [Cloud] Dequeued cloud request.
2026-08-01T14:27:27.525 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T14:27:27.681 [Cloud] End of cloud request.
2026-08-01T14:27:28.197 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T14:27:33.290 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T14:27:33.290 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T14:27:33.290 [Cloud] Queued cloud request.
2026-08-01T14:27:33.290 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T14:27:33.290 [Cloud] Dequeued cloud request.
2026-08-01T14:27:33.290 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T14:27:33.384 [Cloud] End of cloud request.
2026-08-01T14:27:33.884 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T14:28:06.696 [RbM] Setting Last known good engine candidate. hr = 0
2026-08-01T14:32:52.337 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T14:32:52.337 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T14:32:52.337 [Cloud] Queued cloud request.
2026-08-01T14:32:52.337 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T14:32:52.337 [Cloud] Dequeued cloud request.
2026-08-01T14:32:52.353 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T14:32:52.493 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{668B3D98-E57C-1449-B1C0-52C11889BA35}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 14:32:52
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T14:32:53.009 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T14:32:57.415 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T14:48:02.415 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T14:58:20.586 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T14:58:20.586 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T14:58:20.586 [Cloud] Queued cloud request.
2026-08-01T14:58:20.586 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T14:58:20.586 [Cloud] Dequeued cloud request.
2026-08-01T14:58:20.586 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T14:58:20.821 [Cloud] End of cloud request.
2026-08-01T14:58:21.321 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T15:01:14.712 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T15:01:14.712 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T15:01:14.712 [Cloud] Queued cloud request.
2026-08-01T15:01:14.712 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T15:01:14.712 [Cloud] Dequeued cloud request.
2026-08-01T15:01:14.712 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T15:01:14.915 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{113A0735-10BF-2DA8-EFAA-C7C49B1010F6}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 15:01:14
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T15:01:15.415 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T15:03:07.415 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T15:08:43.899 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T15:08:43.899 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T15:08:43.899 [Cloud] Queued cloud request.
2026-08-01T15:08:43.899 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T15:08:43.899 [Cloud] Dequeued cloud request.
2026-08-01T15:08:43.914 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T15:08:44.086 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1FBC529A-2317-AD21-8E5A-99510052BE9A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 15:08:44
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T15:08:44.602 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T15:18:12.414 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T15:25:36.633 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T15:25:36.633 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T15:25:36.633 [Cloud] Queued cloud request.
2026-08-01T15:25:36.633 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T15:25:36.633 [Cloud] Dequeued cloud request.
2026-08-01T15:25:36.633 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T15:25:36.836 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{877CFADB-6554-AB1F-FA63-55FD794993E3}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 15:25:36
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T15:25:37.336 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T15:28:27.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T15:28:27.445 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T15:28:27.445 [Cloud] Queued cloud request.
2026-08-01T15:28:27.445 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T15:28:27.445 [Cloud] Dequeued cloud request.
2026-08-01T15:28:27.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T15:28:27.633 [Cloud] End of cloud request.
2026-08-01T15:28:28.133 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T15:33:06.023 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T15:33:06.023 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T15:33:06.023 [Cloud] Queued cloud request.
2026-08-01T15:33:06.023 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T15:33:06.023 [Cloud] Dequeued cloud request.
2026-08-01T15:33:06.023 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T15:33:06.227 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{B66094F4-E919-C44C-3A26-FB5FA9665A82}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 15:33:06
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T15:33:06.727 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T15:33:10.883 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T15:33:10.883 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T15:33:10.883 [Cloud] Queued cloud request.
2026-08-01T15:33:10.883 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T15:33:10.883 [Cloud] Dequeued cloud request.
2026-08-01T15:33:10.883 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T15:33:10.961 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4D10D9A6-BE93-EE65-CFBE-7A707703C24F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 15:33:10
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T15:33:11.477 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T15:33:17.414 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T15:48:22.414 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T16:03:27.413 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T16:13:34.257 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T16:13:34.257 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T16:13:34.257 [Cloud] Queued cloud request.
2026-08-01T16:13:34.257 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T16:13:34.257 [Cloud] Dequeued cloud request.
2026-08-01T16:13:34.257 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T16:13:34.444 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4E5AC4C6-5E9A-53C3-FCC5-2C7FBE930EA5}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 16:13:34
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T16:13:34.944 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T16:14:12.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T16:14:12.304 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T16:14:12.304 [Cloud] Queued cloud request.
2026-08-01T16:14:12.304 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T16:14:12.304 [Cloud] Dequeued cloud request.
2026-08-01T16:14:12.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T16:14:12.398 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{B96A133D-36C4-5C48-F00E-C2AC6288524A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 16:14:12
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T16:14:12.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T16:18:32.413 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T16:23:06.632 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 4122, Count: 193, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-01T16:23:06.632 ProcessImageName: httpd.exe, Pid: 4916, TotalTime: 2595, Count: 150, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\index.php, EstimatedImpact: 0%
2026-08-01T16:23:06.632 ProcessImageName: WmiPrvSE.exe, Pid: 3116, TotalTime: 577, Count: 39, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 42%
2026-08-01T16:23:06.632 ProcessImageName: powershell.exe, Pid: 7356, TotalTime: 294, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 34%
2026-08-01T16:23:06.632 ProcessImageName: python.exe, Pid: 2956, TotalTime: 289, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\setuptools-69.0.2.dist-info\entry_points.txt, EstimatedImpact: 13%
2026-08-01T16:23:06.632 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 122, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start->(UTF-16LE), EstimatedImpact: 0%
2026-08-01T16:23:06.632 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-01T16:23:06.632 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-01T16:33:07.694 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T16:33:07.694 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T16:33:07.694 [Cloud] Queued cloud request.
2026-08-01T16:33:07.694 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T16:33:07.694 [Cloud] Dequeued cloud request.
2026-08-01T16:33:07.694 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T16:33:07.913 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{92DC1C24-31E8-B547-987F-866170FFC594}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 16:33:07
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T16:33:08.413 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T16:33:37.413 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T16:48:42.413 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T17:03:47.412 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T17:05:36.100 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T17:05:36.100 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T17:05:36.100 [Cloud] Queued cloud request.
2026-08-01T17:05:36.100 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T17:05:36.100 [Cloud] Dequeued cloud request.
2026-08-01T17:05:36.100 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T17:05:36.256 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{BEBA7C85-6C15-39D6-CE39-7D21707EF28C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 17:05:36
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T17:05:36.756 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T17:18:52.412 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T17:22:11.443 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T17:22:11.443 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T17:22:11.443 [Cloud] Queued cloud request.
2026-08-01T17:22:11.443 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T17:22:11.443 [Cloud] Dequeued cloud request.
2026-08-01T17:22:11.443 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T17:22:11.599 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{91A10FD9-169F-6BFD-5E02-49755C24F298}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 17:22:11
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T17:22:12.099 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T17:23:50.756 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T17:23:50.756 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T17:23:50.756 [Cloud] Queued cloud request.
2026-08-01T17:23:50.756 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T17:23:50.756 [Cloud] Dequeued cloud request.
2026-08-01T17:23:50.756 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T17:23:50.912 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{63399A13-1071-539D-7185-5CA91472D194}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 17:23:50
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T17:23:51.427 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T17:28:26.646 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T17:28:26.646 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T17:28:26.646 [Cloud] Queued cloud request.
2026-08-01T17:28:26.646 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T17:28:26.646 [Cloud] Dequeued cloud request.
2026-08-01T17:28:26.646 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T17:28:26.802 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{5DF3E570-4516-480C-8CBA-9599B49098C0}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 17:28:26
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T17:28:27.318 [NRI] Successfully updated NIS service with platform settings for enforcement level Log

BEGIN BM telemetry
GUID:{C2AE1584-85E3-1E84-AF21-01BFB63BB16F}
SignatureID:55746285003867
SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df
ThreatLevel:0
ProcessID:2852
ProcessCreationTime:134285983332457305
SessionID:0
CreationTime:08-01-2026 17:30:26
ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T17:30:27.474 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T17:30:27.474 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T17:30:27.474 [Cloud] Queued cloud request.
2026-08-01T17:30:27.474 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T17:30:27.474 [Cloud] Dequeued cloud request.
2026-08-01T17:30:27.474 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T17:30:27.802 [Cloud] End of cloud request.
2026-08-01T17:30:28.318 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T17:33:23.115 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T17:33:23.115 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T17:33:23.115 [Cloud] Queued cloud request.
2026-08-01T17:33:23.115 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T17:33:23.115 [Cloud] Dequeued cloud request.
2026-08-01T17:33:23.115 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T17:33:23.318 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{21590848-4B46-8C23-6DDD-D4B7D144DB6D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 17:33:23
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T17:33:23.834 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T17:33:45.443 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T17:33:45.443 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T17:33:45.443 [Cloud] Queued cloud request.
2026-08-01T17:33:45.443 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T17:33:45.443 [Cloud] Dequeued cloud request.
2026-08-01T17:33:45.443 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{5F0941CD-776F-0EB7-17C0-1B17CDADDC41}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 17:33:45
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T17:33:45.521 [Cloud] End of cloud request.
2026-08-01T17:33:46.021 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T17:33:57.412 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T17:44:24.411 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T17:44:24.411 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T17:44:24.411 [Cloud] Queued cloud request.
2026-08-01T17:44:24.411 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T17:44:24.411 [Cloud] Dequeued cloud request.
2026-08-01T17:44:24.411 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T17:44:24.615 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{DD62FE90-395A-D9AC-0EF9-FFF6BDE5A511}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 17:44:24
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T17:44:25.115 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T17:44:52.919 ReportLowfi(ctfmon.exe, 0x437a0835) from 0x0006b6bd6566d2d9
2026-08-01T17:44:55.131 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\PrsEE34.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8263569, FileId: 0x1d00000003767f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T17:44:57.131 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\PrsF615.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8263868, FileId: 0x21000000037688, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T17:45:00.117 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temp\Prs1AF.tmp. Process: \Device\HarddiskVolume2\Windows\System32\rdpclip.exe, Status: 0xc0000001, State: 0, ScanRequest #8264207, FileId: 0x800000000e045, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T17:49:02.411 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T17:51:23.208 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T17:51:23.224 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T17:51:23.224 [Cloud] Queued cloud request.
2026-08-01T17:51:23.224 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T17:51:23.224 [Cloud] Dequeued cloud request.
2026-08-01T17:51:23.224 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T17:51:23.411 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2A3A0B12-483B-AFD4-ED20-037AAFDAAF56}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 17:51:23
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T17:51:23.911 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T18:04:07.411 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T18:13:59.661 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T18:13:59.661 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T18:13:59.661 [Cloud] Queued cloud request.
2026-08-01T18:13:59.661 [Cloud] Dequeued cloud request.
2026-08-01T18:13:59.661 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T18:13:59.661 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T18:13:59.817 [Cloud] End of cloud request.
2026-08-01T18:14:00.317 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x4928fc66
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd2c52ecd
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xbc38d0a9
2026-08-01T18:14:24.630 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T18:14:24.630 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T18:14:24.630 [Cloud] Queued cloud request.
2026-08-01T18:14:24.630 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T18:14:24.630 [Cloud] Dequeued cloud request.
2026-08-01T18:14:24.630 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xc8cbabb9
2026-08-01T18:14:24.723 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T18:14:24.723 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T18:14:24.723 [Cloud] Queued cloud request.
2026-08-01T18:14:24.723 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T18:14:24.723 [Cloud] Dequeued cloud request.
2026-08-01T18:14:24.723 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T18:14:24.926 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\86abb98df49dd74d5eecde7e98c38f1adbe016df
Dynamic Signature Compilation Timestamp:08-01-2026 18:14:24
Persistence Type:Duration
Time remaining:50065408
2026-08-01T18:14:24.926 RTSD:RTSD recieved, rescanning impacted resources
2026-08-01T18:14:24.926 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xe2d829c6
2026-08-01T18:14:25.036 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T18:14:25.036 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T18:14:25.036 [Cloud] Queued cloud request.
2026-08-01T18:14:25.036 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T18:14:25.036 [Cloud] Dequeued cloud request.
2026-08-01T18:14:25.036 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T18:14:25.145 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\85f8841dd03d26081014f0816cfe168832704bd5
Dynamic Signature Compilation Timestamp:08-01-2026 18:14:25
Persistence Type:Duration
Time remaining:150196224
2026-08-01T18:14:25.145 RTSD:RTSD recieved, rescanning impacted resources
2026-08-01T18:14:25.145 [Cloud] End of cloud request.
2026-08-01T18:14:25.301 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\c98854d82a309018847a9e6688932f9862379f58
Dynamic Signature Compilation Timestamp:08-01-2026 18:14:25
Persistence Type:Duration
Time remaining:50065408
2026-08-01T18:14:25.301 RTSD:RTSD recieved, rescanning impacted resources
2026-08-01T18:14:25.301 [Cloud] End of cloud request.
2026-08-01T18:14:25.442 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T18:19:12.410 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T18:22:47.521 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T18:22:47.521 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T18:22:47.521 [Cloud] Queued cloud request.
2026-08-01T18:22:47.521 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T18:22:47.521 [Cloud] Dequeued cloud request.
2026-08-01T18:22:47.521 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T18:22:47.677 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{63F63B9E-3FD1-FA42-989E-31CE160888C1}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 18:22:47
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T18:22:48.177 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T18:22:52.177 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T18:22:52.177 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T18:22:52.177 [Cloud] Queued cloud request.
2026-08-01T18:22:52.177 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T18:22:52.177 [Cloud] Dequeued cloud request.
2026-08-01T18:22:52.177 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T18:22:52.255 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1DA86624-5127-FE4E-64B7-015541331899}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 18:22:52
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T18:22:52.756 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T18:23:06.638 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 8225, Count: 389, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-01T18:23:06.638 ProcessImageName: httpd.exe, Pid: 4916, TotalTime: 5870, Count: 331, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\googlemaps\Wienerberg_20050613.html->(SCRIPT0002), EstimatedImpact: 0%
2026-08-01T18:23:06.638 ProcessImageName: explorer.exe, Pid: 5148, TotalTime: 1817, Count: 25, MaxTime: 656, MaxTimeFile: \Device\HarddiskVolume2\nginx\nginx.exe, EstimatedImpact: 0%
2026-08-01T18:23:06.638 ProcessImageName: explorer.exe, Pid: 3232, TotalTime: 1346, Count: 68, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-01T18:23:06.638 ProcessImageName: AgentShellSystemTray.exe, Pid: 2184, TotalTime: 895, Count: 34, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 33%
2026-08-01T18:23:06.638 ProcessImageName: WmiPrvSE.exe, Pid: 3116, TotalTime: 577, Count: 39, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 42%
2026-08-01T18:23:06.638 ProcessImageName: RuntimeBroker.exe, Pid: 6732, TotalTime: 530, Count: 3, MaxTime: 500, MaxTimeFile: \Device\HarddiskVolume2\Program Files\FileZilla FTP Client\filezilla.exe, EstimatedImpact: 22%
2026-08-01T18:23:06.638 ProcessImageName: runonce.exe, Pid: 7404, TotalTime: 447, Count: 14, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 30%
2026-08-01T18:23:06.638 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 337, Count: 15, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-01T18:23:06.638 ProcessImageName: powershell.exe, Pid: 7356, TotalTime: 294, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 34%
2026-08-01T18:23:06.638 ProcessImageName: python.exe, Pid: 2956, TotalTime: 289, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\setuptools-69.0.2.dist-info\entry_points.txt, EstimatedImpact: 13%
2026-08-01T18:23:06.638 ProcessImageName: mmc.exe, Pid: 4572, TotalTime: 277, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\c2f05f765d8b9324d606f711fe96f209\MIGUIControls.ni.dll, EstimatedImpact: 3%
2026-08-01T18:23:06.638 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 260, Count: 16, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\spool\V4Dirs\2A69E168-833E-4BE0-9D9D-6E354AC311E8\merged.gpd, EstimatedImpact: 4%
2026-08-01T18:23:06.638 ProcessImageName: dllhost.exe, Pid: 4576, TotalTime: 259, Count: 17, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk, EstimatedImpact: 0%
2026-08-01T18:23:06.638 ProcessImageName: mmc.exe, Pid: 9088, TotalTime: 231, Count: 8, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\KZ3GNUWD\views[1], EstimatedImpact: 5%
2026-08-01T18:23:06.638 ProcessImageName: svchost.exe, Pid: 5220, TotalTime: 218, Count: 2, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\DO89A9.tmp, EstimatedImpact: 66%
2026-08-01T18:23:06.638 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 122, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log, EstimatedImpact: 0%
2026-08-01T18:23:06.638 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-01T18:23:06.638 ProcessImageName: python.exe, Pid: 4068, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\accounts\acme-v02.api.letsencrypt.org\directory\612050855f7c1a31bed06818996045ed\regr.json, EstimatedImpact: 28%
2026-08-01T18:23:06.638 ProcessImageName: svchost.exe, Pid: 2972, TotalTime: 61, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator.cdpresource, EstimatedImpact: 1%
2026-08-01T18:23:06.638 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-01T18:23:06.638 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 7348, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log, EstimatedImpact: 37%
2026-08-01T18:23:06.638 ProcessImageName: python.exe, Pid: 1792, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\.well-known\acme-challenge\web.config, EstimatedImpact: 2%
2026-08-01T18:23:06.638 ProcessImageName: svchost.exe, Pid: 1360, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\prn0037.tmp, EstimatedImpact: 0%
2026-08-01T18:33:57.895 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T18:33:57.895 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T18:33:57.895 [Cloud] Queued cloud request.
2026-08-01T18:33:57.895 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T18:33:57.895 [Cloud] Dequeued cloud request.
2026-08-01T18:33:57.895 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T18:33:58.036 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{427A369C-40D5-9D1D-E833-C15B63A9604C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 18:33:58
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T18:33:58.551 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T18:34:17.411 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T18:39:01.176 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T18:39:01.176 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T18:39:01.176 [Cloud] Queued cloud request.
2026-08-01T18:39:01.176 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T18:39:01.176 [Cloud] Dequeued cloud request.
2026-08-01T18:39:01.176 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T18:39:01.332 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{AD5B34CE-9F69-B5AA-FC9B-C701E2159265}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 18:39:01
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T18:39:01.832 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T18:40:44.129 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T18:40:44.129 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T18:40:44.129 [Cloud] Queued cloud request.
2026-08-01T18:40:44.129 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T18:40:44.129 [Cloud] Dequeued cloud request.
2026-08-01T18:40:44.129 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T18:40:44.270 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{C304AB7C-549C-F06C-81FE-ECFAC742008B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 18:40:44
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T18:40:44.785 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T18:46:53.317 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T18:46:53.317 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T18:46:53.317 [Cloud] Queued cloud request.
2026-08-01T18:46:53.317 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T18:46:53.317 [Cloud] Dequeued cloud request.
2026-08-01T18:46:53.317 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T18:46:53.520 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{BB3FDF15-551C-9387-3315-5407D3EAC258}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 18:46:53
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T18:46:54.020 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T18:48:16.301 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T18:48:16.301 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T18:48:16.301 [Cloud] Queued cloud request.
2026-08-01T18:48:16.301 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T18:48:16.301 [Cloud] Dequeued cloud request.
2026-08-01T18:48:16.301 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T18:48:16.488 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{49BBD1FB-90A1-0C92-E8C9-0B392F9913F9}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 18:48:16
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T18:48:16.988 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T18:49:22.410 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T19:04:27.410 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T19:06:00.051 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T19:06:00.051 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T19:06:00.051 [Cloud] Queued cloud request.
2026-08-01T19:06:00.051 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T19:06:00.051 [Cloud] Dequeued cloud request.
2026-08-01T19:06:00.051 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T19:06:00.238 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E04108BF-8909-3AFE-1DDF-E84292725C6C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 19:06:00
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T19:06:00.738 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T19:19:32.410 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T19:34:16.784 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T19:34:16.784 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T19:34:16.784 [Cloud] Queued cloud request.
2026-08-01T19:34:16.784 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T19:34:16.784 [Cloud] Dequeued cloud request.
2026-08-01T19:34:16.784 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T19:34:16.972 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{FF643480-0960-8A83-46A6-BE6C8D1AE435}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 19:34:16
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T19:34:17.472 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T19:34:37.409 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T19:35:02.909 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T19:35:02.909 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T19:35:02.909 [Cloud] Queued cloud request.
2026-08-01T19:35:02.909 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T19:35:02.909 [Cloud] Dequeued cloud request.
2026-08-01T19:35:02.909 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T19:35:03.003 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{CAEEF5B2-6007-E6D2-9CDA-5D7F66F40B3D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 19:35:03
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T19:35:03.503 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T19:39:26.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T19:39:26.097 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T19:39:26.097 [Cloud] Queued cloud request.
2026-08-01T19:39:26.097 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T19:39:26.097 [Cloud] Dequeued cloud request.
2026-08-01T19:39:26.097 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T19:39:26.284 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2CA788BB-C8FB-26A8-33B6-D8D4FE1F0855}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 19:39:26
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T19:39:26.784 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T19:41:47.378 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T19:41:47.378 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T19:41:47.378 [Cloud] Queued cloud request.
2026-08-01T19:41:47.378 [Cloud] Dequeued cloud request.
2026-08-01T19:41:47.378 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T19:41:47.378 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T19:41:47.628 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{5EE50E77-E1CE-51D2-1BC0-6BE79C8E507B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 19:41:47
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T19:41:48.144 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T19:46:15.362 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\logs\error.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8308206, FileId: 0x100000008005c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x5c225204
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xaacfd3cd
2026-08-01T19:47:25.300 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T19:47:25.300 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T19:47:25.300 [Cloud] Queued cloud request.
2026-08-01T19:47:25.300 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T19:47:25.300 [Cloud] Dequeued cloud request.
2026-08-01T19:47:25.300 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd70cdbed
2026-08-01T19:47:25.347 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T19:47:25.347 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T19:47:25.347 [Cloud] Queued cloud request.
2026-08-01T19:47:25.347 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T19:47:25.347 [Cloud] Dequeued cloud request.
2026-08-01T19:47:25.347 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\08eeae3e4de0914daaf44b38b862d9f287895464
Dynamic Signature Compilation Timestamp:08-01-2026 19:47:25
Persistence Type:Duration
Time remaining:50065408
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\e11a75127ded22f04c517cb4430e42f0b485bf85
Dynamic Signature Compilation Timestamp:08-01-2026 19:47:25
Persistence Type:Duration
Time remaining:50065408
2026-08-01T19:47:25.545 Dynamic signature received
2026-08-01T19:47:25.545 Dynamic signature received
2026-08-01T19:47:25.545 RTSD:RTSD recieved, rescanning impacted resources
2026-08-01T19:47:25.545 [Cloud] End of cloud request.
2026-08-01T19:47:25.545 RTSD:RTSD recieved, rescanning impacted resources
2026-08-01T19:47:25.561 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x4cd2b4c6
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x79afc6df
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xa5be034f
2026-08-01T19:47:25.894 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T19:47:25.894 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T19:47:25.894 [Cloud] Queued cloud request.
2026-08-01T19:47:25.894 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T19:47:25.894 [Cloud] Dequeued cloud request.
2026-08-01T19:47:25.894 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T19:47:26.065 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T19:47:26.112 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\ea61416dbd1d3a82f922dd8c00f3802b7cdc3165
Dynamic Signature Compilation Timestamp:08-01-2026 19:47:26
Persistence Type:Duration
Time remaining:50065408
2026-08-01T19:47:26.112 RTSD:RTSD recieved, rescanning impacted resources
2026-08-01T19:47:26.112 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd13bf3e7
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x128ddcdd
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xa179bd1a
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x90cdec3e
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x6809b818
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x8bf850b5
2026-08-01T19:47:26.612 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x68006e9e
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x411967ac
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x24f8d9e2
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x7dce467c
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xaa1d1e73
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xddb72c49
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xc17e2648
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x80954533
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xce72856c
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xb306d33b
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x26be9100
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x7447ebd6
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x03b51a1e
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf516d0f7
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x135e7b78
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x27db6f1a
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x1e1dbe24
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xa0150f71
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xeb95fb30
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x16a6a2dc
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x6763306e
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xa1508056
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf4390465
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xb197890a
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x09bfc31e
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xa290beaf
2026-08-01T19:49:42.409 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T19:54:30.565 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T19:54:30.565 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T19:54:30.565 [Cloud] Queued cloud request.
2026-08-01T19:54:30.565 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T19:54:30.565 [Cloud] Dequeued cloud request.
2026-08-01T19:54:30.565 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T19:54:30.722 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{43AB1532-4850-B02A-1954-B5C8C8699347}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 19:54:30
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T19:54:31.222 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xac0f7a25
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x90c96789
2026-08-01T20:04:47.409 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T20:13:49.731 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T20:13:49.731 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T20:13:49.731 [Cloud] Queued cloud request.
2026-08-01T20:13:49.731 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T20:13:49.731 [Cloud] Dequeued cloud request.
2026-08-01T20:13:49.731 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T20:13:49.919 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F2D07898-0B73-B3B9-17CC-E57226E97AC3}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 20:13:49
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T20:13:50.434 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T20:19:52.408 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T20:23:06.643 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 12509, Count: 584, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-01T20:23:06.643 ProcessImageName: httpd.exe, Pid: 4916, TotalTime: 6548, Count: 354, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\googlemaps\Wienerberg_20050613.html->(SCRIPT0002), EstimatedImpact: 0%
2026-08-01T20:23:06.643 ProcessImageName: explorer.exe, Pid: 3232, TotalTime: 3408, Count: 190, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-01T20:23:06.643 ProcessImageName: explorer.exe, Pid: 5148, TotalTime: 2871, Count: 45, MaxTime: 656, MaxTimeFile: \Device\HarddiskVolume2\nginx\nginx.exe, EstimatedImpact: 0%
2026-08-01T20:23:06.643 ProcessImageName: httpd.exe, Pid: 4344, TotalTime: 1248, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libhttpd.dll, EstimatedImpact: 74%
2026-08-01T20:23:06.643 ProcessImageName: AgentShellSystemTray.exe, Pid: 2184, TotalTime: 895, Count: 34, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 33%
2026-08-01T20:23:06.643 ProcessImageName: httpd.exe, Pid: 8796, TotalTime: 893, Count: 21, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\PHP53\ext\ioncube_loader_win_5.3.dll, EstimatedImpact: 53%
2026-08-01T20:23:06.643 ProcessImageName: httpd.exe, Pid: 3452, TotalTime: 635, Count: 13, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php5ts.dll, EstimatedImpact: 96%
2026-08-01T20:23:06.643 ProcessImageName: WmiPrvSE.exe, Pid: 3116, TotalTime: 577, Count: 39, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 42%
2026-08-01T20:23:06.643 ProcessImageName: openssl.exe, Pid: 5900, TotalTime: 562, Count: 3, MaxTime: 406, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libcrypto-3-x64.dll, EstimatedImpact: 100%
2026-08-01T20:23:06.643 ProcessImageName: RuntimeBroker.exe, Pid: 6732, TotalTime: 530, Count: 3, MaxTime: 500, MaxTimeFile: \Device\HarddiskVolume2\Program Files\FileZilla FTP Client\filezilla.exe, EstimatedImpact: 22%
2026-08-01T20:23:06.643 ProcessImageName: dllhost.exe, Pid: 4576, TotalTime: 471, Count: 33, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk, EstimatedImpact: 0%
2026-08-01T20:23:06.643 ProcessImageName: runonce.exe, Pid: 7404, TotalTime: 447, Count: 14, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 30%
2026-08-01T20:23:06.643 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 397, Count: 19, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-01T20:23:06.643 ProcessImageName: mmc.exe, Pid: 4572, TotalTime: 308, Count: 16, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\c2f05f765d8b9324d606f711fe96f209\MIGUIControls.ni.dll, EstimatedImpact: 0%
2026-08-01T20:23:06.643 ProcessImageName: powershell.exe, Pid: 7356, TotalTime: 294, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 34%
2026-08-01T20:23:06.643 ProcessImageName: python.exe, Pid: 2956, TotalTime: 289, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\setuptools-69.0.2.dist-info\entry_points.txt, EstimatedImpact: 13%
2026-08-01T20:23:06.643 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 260, Count: 16, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\spool\V4Dirs\2A69E168-833E-4BE0-9D9D-6E354AC311E8\merged.gpd, EstimatedImpact: 4%
2026-08-01T20:23:06.643 ProcessImageName: mmc.exe, Pid: 9088, TotalTime: 231, Count: 8, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\KZ3GNUWD\views[1], EstimatedImpact: 5%
2026-08-01T20:23:06.643 ProcessImageName: cmd.exe, Pid: 4580, TotalTime: 218, Count: 2, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\OpenSSL.exe, EstimatedImpact: 0%
2026-08-01T20:23:06.643 ProcessImageName: svchost.exe, Pid: 5220, TotalTime: 218, Count: 2, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\DO89A9.tmp, EstimatedImpact: 66%
2026-08-01T20:23:06.643 ProcessImageName: httpd.exe, Pid: 3172, TotalTime: 171, Count: 12, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_noframes.html, EstimatedImpact: 0%
2026-08-01T20:23:06.643 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 122, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log, EstimatedImpact: 0%
2026-08-01T20:23:06.643 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-01T20:23:06.643 ProcessImageName: python.exe, Pid: 4068, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\accounts\acme-v02.api.letsencrypt.org\directory\612050855f7c1a31bed06818996045ed\regr.json, EstimatedImpact: 28%
2026-08-01T20:23:06.643 ProcessImageName: notepad.exe, Pid: 8360, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-01T20:23:06.643 ProcessImageName: svchost.exe, Pid: 2972, TotalTime: 61, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator.cdpresource, EstimatedImpact: 1%
2026-08-01T20:23:06.643 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-01T20:23:06.643 ProcessImageName: notepad.exe, Pid: 9076, TotalTime: 61, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-01T20:23:06.643 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 7348, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log, EstimatedImpact: 37%
2026-08-01T20:23:06.643 ProcessImageName: python.exe, Pid: 1792, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\.well-known\acme-challenge\web.config, EstimatedImpact: 2%
2026-08-01T20:23:06.643 ProcessImageName: svchost.exe, Pid: 1360, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\prn0037.tmp, EstimatedImpact: 0%
2026-08-01T20:30:32.814 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T20:30:32.814 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T20:30:32.814 [Cloud] Queued cloud request.
2026-08-01T20:30:32.814 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T20:30:32.814 [Cloud] Dequeued cloud request.
2026-08-01T20:30:32.814 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T20:30:32.971 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1BBD0502-DB85-094C-C330-8FAE2F5CA207}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 20:30:32
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T20:30:33.471 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T20:34:57.408 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T20:38:35.330 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T20:38:35.330 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T20:38:35.330 [Cloud] Queued cloud request.
2026-08-01T20:38:35.330 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T20:38:35.330 [Cloud] Dequeued cloud request.
2026-08-01T20:38:35.330 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T20:38:35.486 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E70EEF31-0477-C151-364D-3EF2F6DA5489}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 20:38:35
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T20:38:36.002 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T20:50:02.408 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T20:52:01.986 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T20:52:01.986 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T20:52:01.986 [Cloud] Queued cloud request.
2026-08-01T20:52:01.986 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T20:52:01.986 [Cloud] Dequeued cloud request.
2026-08-01T20:52:01.986 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T20:52:02.189 [Cloud] End of cloud request.
2026-08-01T20:52:02.689 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T20:55:02.877 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T20:55:02.877 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T20:55:02.877 [Cloud] Queued cloud request.
2026-08-01T20:55:02.877 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T20:55:02.877 [Cloud] Dequeued cloud request.
2026-08-01T20:55:02.877 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T20:55:03.361 [Cloud] End of cloud request.
2026-08-01T20:55:03.876 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd75667ec
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x815ef3a1
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x57995ad7
2026-08-01T20:55:11.205 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T20:55:11.205 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T20:55:11.205 [Cloud] Queued cloud request.
2026-08-01T20:55:11.205 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T20:55:11.205 [Cloud] Dequeued cloud request.
2026-08-01T20:55:11.205 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T20:55:11.392 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\cfaf9f46ecd3420d4143e4beb545ad8ea61cf668
Dynamic Signature Compilation Timestamp:08-01-2026 20:55:11
Persistence Type:Duration
Time remaining:50065408
2026-08-01T20:55:11.408 RTSD:RTSD recieved, rescanning impacted resources
2026-08-01T20:55:11.408 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf983493d
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xcaa8cd7b
2026-08-01T20:55:11.908 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:03:52.033 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:03:52.033 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:03:52.033 [Cloud] Queued cloud request.
2026-08-01T21:03:52.033 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:03:52.033 [Cloud] Dequeued cloud request.
2026-08-01T21:03:52.033 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:03:52.236 [Cloud] End of cloud request.
2026-08-01T21:03:52.751 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:05:07.408 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T21:08:53.814 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:08:53.814 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:08:53.814 [Cloud] Queued cloud request.
2026-08-01T21:08:53.814 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:08:53.814 [Cloud] Dequeued cloud request.
2026-08-01T21:08:53.814 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:08:54.001 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{67AC08A2-EACB-395E-17B6-84A0E0B72D3E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 21:08:54
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T21:08:54.518 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x587a774a
2026-08-01T21:11:07.579 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:11:07.579 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:11:07.579 [Cloud] Queued cloud request.
2026-08-01T21:11:07.579 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:11:07.579 [Cloud] Dequeued cloud request.
2026-08-01T21:11:07.579 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:11:07.782 [Cloud] End of cloud request.
2026-08-01T21:11:08.282 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:20:06.892 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:20:06.892 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:20:06.892 [Cloud] Queued cloud request.
2026-08-01T21:20:06.892 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:20:06.892 [Cloud] Dequeued cloud request.
2026-08-01T21:20:06.892 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:20:07.032 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{739BA018-F352-8B65-762F-4C94681CD765}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 21:20:07
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T21:20:07.548 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:20:12.407 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)

BEGIN BM telemetry
GUID:{F32280B3-EB4D-6497-20FF-2A4455FBADCB}
SignatureID:340520518878414
SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0
ThreatLevel:0
ProcessID:4364
ProcessCreationTime:134300926691185095
SessionID:0
CreationTime:08-01-2026 21:26:00
ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
Taint Info:Friendly: Y; Reason: ; Modules: C:\Program Files (x86)\Apache Software Foundation\Apache2.2\modules\mod_log_config.so:25,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\modules\mod_mime.so:25,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\modules\mod_negotiation.so:25,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\modules\mod_rewrite.so:25,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\modules\mod_setenvif.so:25,C:\PHP53\php5apache2_2.dll:25,C:\PHP53\php5ts.dll:25,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\modules\mod_log_config.so:25,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\modules\mod_mime.so:25,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\modules\mod_negotiation.so:25,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\modules\mod_rewrite.so:25,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\modules\mod_setenvif.so:25,C:\PHP53\php5apache2_2.dll:25,C:\PHP53\php5ts.dll:25,C:\PHP53\ext\ioncube_loader_win_5.3.dll:25,C:\PHP53\ext\php_curl.dll:25,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\zlib1.dll:25,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ssleay32.dll:25,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\libeay32.dll:25,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ssleay32.dll:25,; Parents: C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe:4408:1,C:\Windows\System32\lsass.exe:628:2,C:\Windows\System32\csrss.exe:404:2,
Operations:None
END BM telemetry


BEGIN BM telemetry
GUID:{392829A4-7A92-6343-748D-230E68CEA95F}
SignatureID:55745797457393
SigSha:ddb4adac2aca8c16554162e265921a50721a9574
ThreatLevel:0
ProcessID:3744
ProcessCreationTime:134300931599727633
SessionID:0
CreationTime:08-01-2026 21:26:00
ImagePath:C:\Windows\SysWOW64\cmd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: C:\Windows\System32\services.exe:620:2,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe:4364:3,C:\Windows\System32\lsass.exe:628:2,C:\Windows\System32\csrss.exe:404:2,C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe:4408:2,
Operations:None
END BM telemetry

2026-08-01T21:26:01.407 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:26:01.407 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:26:01.407 [Cloud] Queued cloud request.
2026-08-01T21:26:01.407 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:26:01.407 [Cloud] Dequeued cloud request.
2026-08-01T21:26:01.407 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:26:01.767 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\9bb09634e6185749cc55a802ccd822700cd3e219
Dynamic Signature Compilation Timestamp:08-01-2026 21:26:01
Persistence Type:Duration
Time remaining:150196224
2026-08-01T21:26:01.767 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\4d1f0e9fb3ae45d0f5f85713109afb11e1a79d8f
Dynamic Signature Compilation Timestamp:08-01-2026 21:26:01
Persistence Type:Duration
Time remaining:150196224
2026-08-01T21:26:01.767 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\cda330cc54383560a1394f122cfe6af344988fa9
Dynamic Signature Compilation Timestamp:08-01-2026 21:26:01
Persistence Type:Duration
Time remaining:150196224
2026-08-01T21:26:01.767 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\4c5be4fe369ea1b3ebabcafeb37cdc894a69ab2c
Dynamic Signature Compilation Timestamp:08-01-2026 21:26:01
Persistence Type:Duration
Time remaining:150196224
2026-08-01T21:26:01.767 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\492a10a1e1020f7665b540deb206ccb5058ba10c
Dynamic Signature Compilation Timestamp:08-01-2026 21:26:01
Persistence Type:Duration
Time remaining:50065408
2026-08-01T21:26:01.767 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\5df5f41e813eb765a05f02c99f001bb7321fe163
Dynamic Signature Compilation Timestamp:08-01-2026 21:26:01
Persistence Type:Duration
Time remaining:50065408
2026-08-01T21:26:01.767 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\759bd763ed6ee28a682fac7bff84943b88ac767e
Dynamic Signature Compilation Timestamp:08-01-2026 21:26:01
Persistence Type:Duration
Time remaining:150196224
2026-08-01T21:26:01.767 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\71ab34f18889edec15c2d0f1f156a2e061ea7321
Dynamic Signature Compilation Timestamp:08-01-2026 21:26:01
Persistence Type:Duration
Time remaining:150196224
2026-08-01T21:26:01.767 [Cloud] End of cloud request.
2026-08-01T21:26:02.282 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:26:09.485 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:26:09.485 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:26:09.485 [Cloud] Queued cloud request.
2026-08-01T21:26:09.485 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:26:09.485 [Cloud] Dequeued cloud request.
2026-08-01T21:26:09.485 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:26:09.782 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\fe1a51e5ca82f2db20c44788490686bc30e6bc73
Dynamic Signature Compilation Timestamp:08-01-2026 21:26:09
Persistence Type:Duration
Time remaining:288000000
2026-08-01T21:26:09.782 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\66a2eee71f24920b91a57b41b7abe4467d2c880f
Dynamic Signature Compilation Timestamp:08-01-2026 21:26:09
Persistence Type:Duration
Time remaining:50065408
2026-08-01T21:26:09.782 [Cloud] End of cloud request.
2026-08-01T21:26:10.282 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:26:14.657 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:26:14.657 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:26:14.657 [Cloud] Queued cloud request.
2026-08-01T21:26:14.657 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:26:14.657 [Cloud] Dequeued cloud request.
2026-08-01T21:26:14.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:26:14.720 [Cloud] End of cloud request.
2026-08-01T21:26:14.735 Bm signature throttled:0x000135b39c9104ce
2026-08-01T21:26:15.220 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:26:15.313 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:26:15.313 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:26:15.313 [Cloud] Queued cloud request.
2026-08-01T21:26:15.313 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:26:15.313 [Cloud] Dequeued cloud request.
2026-08-01T21:26:15.313 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:26:15.376 [Cloud] End of cloud request.
2026-08-01T21:26:15.454 Bm signature throttled:0x000032b3547485f1
2026-08-01T21:26:15.845 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:26:15.845 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:26:15.845 [Cloud] Queued cloud request.
2026-08-01T21:26:15.845 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:26:15.845 [Cloud] Dequeued cloud request.
2026-08-01T21:26:15.845 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:26:15.892 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:26:15.907 [Cloud] End of cloud request.
2026-08-01T21:26:16.407 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:26:18.970 Bm signature throttled:0x000032b3547485f1
2026-08-01T21:26:19.063 Bm signature throttled:0x000032b3547485f1
2026-08-01T21:26:19.126 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:26:19.126 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:26:19.126 [Cloud] Queued cloud request.
2026-08-01T21:26:19.126 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:26:19.126 [Cloud] Dequeued cloud request.
2026-08-01T21:26:19.126 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:26:19.188 [Cloud] End of cloud request.
2026-08-01T21:26:19.298 Bm signature throttled:0x000032b3547485f1
2026-08-01T21:26:19.704 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:26:21.657 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:26:21.657 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:26:21.657 [Cloud] Queued cloud request.
2026-08-01T21:26:21.657 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:26:21.657 [Cloud] Dequeued cloud request.
2026-08-01T21:26:21.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:26:21.751 [Cloud] End of cloud request.
2026-08-01T21:26:21.767 Bm signature throttled:0x000032b3547485f1
2026-08-01T21:26:22.267 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:26:24.954 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:26:24.954 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:26:24.954 [Cloud] Queued cloud request.
2026-08-01T21:26:24.954 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:26:24.954 [Cloud] Dequeued cloud request.
2026-08-01T21:26:24.954 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:26:25.204 [Cloud] End of cloud request.
2026-08-01T21:26:25.735 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:29:47.595 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:29:47.595 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:29:47.595 [Cloud] Queued cloud request.
2026-08-01T21:29:47.595 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:29:47.595 [Cloud] Dequeued cloud request.
2026-08-01T21:29:47.595 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:29:47.766 [Cloud] End of cloud request.
2026-08-01T21:29:48.266 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:33:39.657 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:33:39.657 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:33:39.657 [Cloud] Queued cloud request.
2026-08-01T21:33:39.657 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:33:39.657 [Cloud] Dequeued cloud request.
2026-08-01T21:33:39.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:33:39.845 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{3722D90C-1541-DB7F-CB51-9B96584F7860}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 21:33:39
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T21:33:40.360 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:35:17.407 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T21:40:03.469 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:40:03.469 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:40:03.469 [Cloud] Queued cloud request.
2026-08-01T21:40:03.469 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:40:03.469 [Cloud] Dequeued cloud request.
2026-08-01T21:40:03.469 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:40:03.657 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{433DB97C-DFAA-2E65-DAEC-9E9BF6C051DC}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 21:40:03
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T21:40:04.157 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:41:27.722 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:41:27.722 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:41:27.722 [Cloud] Queued cloud request.
2026-08-01T21:41:27.722 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:41:27.722 [Cloud] Dequeued cloud request.
2026-08-01T21:41:27.722 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:41:27.909 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{B8CB8CAB-66A0-B48C-B324-4DEAB781291F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 21:41:27
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T21:41:28.425 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:46:48.157 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-260d-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8349908, FileId: 0x25000000051a5b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T21:46:48.157 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-260d-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8349909, FileId: 0xf0000000461f5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
Internal signature match:subtype=Lowfi, sigseq=0x0000B7E7E3853B49, sigsha=6bf0cce652e2ec4f3e9675427bd421bde1c7050c, cached=false, source=2, resourceid=0x9ef33b86
2026-08-01T21:47:00.251 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:47:00.251 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:47:00.251 [Cloud] Queued cloud request.
2026-08-01T21:47:00.251 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:47:00.251 [Cloud] Dequeued cloud request.
2026-08-01T21:47:00.320 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\60a0122b09f9fab9fb501ac78d04e84238722822
Dynamic Signature Compilation Timestamp:08-01-2026 21:47:02
Persistence Type:Duration
Time remaining:50065408
2026-08-01T21:47:03.640 RTSD:RTSD recieved, rescanning impacted resources
2026-08-01T21:47:03.640 Dynamic signature received
2026-08-01T21:47:03.766 [Cloud] End of cloud request.
2026-08-01T21:47:04.352 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T21:47:05.383 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-263d-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8350100, FileId: 0x90000000c3f9f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T21:47:05.383 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-263d-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8350101, FileId: 0xb0000000c3f98, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T21:50:22.399 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T21:51:01.360 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T21:51:01.360 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T21:51:01.360 [Cloud] Queued cloud request.
2026-08-01T21:51:01.360 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T21:51:01.360 [Cloud] Dequeued cloud request.
2026-08-01T21:51:01.360 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T21:51:01.532 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2E63B51F-6403-EC7C-06B5-E704935F9D4A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 21:51:01
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T21:51:02.047 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T22:05:27.407 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T22:07:03.360 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T22:07:03.360 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T22:07:03.360 [Cloud] Queued cloud request.
2026-08-01T22:07:03.360 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T22:07:03.360 [Cloud] Dequeued cloud request.
2026-08-01T22:07:03.360 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T22:07:03.547 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{D0B8D87B-13B7-3626-5305-BB409C31304B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 22:07:03
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T22:07:04.063 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T22:14:17.016 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\IDR_XML_DEFAULT_TRANSFORM[1]. Process: \Device\HarddiskVolume2\Windows\System32\taskhostw.exe, Status: 0xc0000001, State: 0, ScanRequest #8360347, FileId: 0xc50000000085c4, Reason: OnClose, IoStatusBlockForNewFile: 0x3, DesiredAccess:0x0, FileAttributes:0x2020, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:20:32.404 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T22:23:06.641 ProcessImageName: httpd.exe, Pid: 4364, TotalTime: 34561, Count: 1662, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 16773, Count: 794, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: httpd.exe, Pid: 4916, TotalTime: 6548, Count: 354, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\googlemaps\Wienerberg_20050613.html->(SCRIPT0002), EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: explorer.exe, Pid: 3232, TotalTime: 5861, Count: 310, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: explorer.exe, Pid: 5148, TotalTime: 2871, Count: 45, MaxTime: 656, MaxTimeFile: \Device\HarddiskVolume2\nginx\nginx.exe, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: explorer.exe, Pid: 4500, TotalTime: 2064, Count: 145, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$IAGSLW9.php, EstimatedImpact: 75%
2026-08-01T22:23:06.641 ProcessImageName: powershell.exe, Pid: 9088, TotalTime: 1977, Count: 90, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\000a53285985b0def7f9930691f067ae\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 35%
2026-08-01T22:23:06.641 ProcessImageName: httpd.exe, Pid: 4344, TotalTime: 1248, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libhttpd.dll, EstimatedImpact: 74%
2026-08-01T22:23:06.641 ProcessImageName: httpd.exe, Pid: 7652, TotalTime: 963, Count: 73, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\sPHDG69Fsq42ArEA9e-xxABuiC5BbJ9i8japwI9iric, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: AgentShellSystemTray.exe, Pid: 2184, TotalTime: 895, Count: 34, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 33%
2026-08-01T22:23:06.641 ProcessImageName: httpd.exe, Pid: 8796, TotalTime: 893, Count: 21, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\PHP53\ext\ioncube_loader_win_5.3.dll, EstimatedImpact: 53%
2026-08-01T22:23:06.641 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 733, Count: 35, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: dllhost.exe, Pid: 4576, TotalTime: 729, Count: 53, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: WmiPrvSE.exe, Pid: 7884, TotalTime: 722, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 13%
2026-08-01T22:23:06.641 ProcessImageName: explorer.exe, Pid: 1100, TotalTime: 700, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$I30CG93, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: httpd.exe, Pid: 3452, TotalTime: 635, Count: 13, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php5ts.dll, EstimatedImpact: 96%
2026-08-01T22:23:06.641 ProcessImageName: powershell.exe, Pid: 3424, TotalTime: 634, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\b96f467c2d8ead8ce81b4cdd1f08846e\System.Management.Automation.ni.dll, EstimatedImpact: 20%
2026-08-01T22:23:06.641 ProcessImageName: WmiPrvSE.exe, Pid: 3116, TotalTime: 577, Count: 39, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 42%
2026-08-01T22:23:06.641 ProcessImageName: openssl.exe, Pid: 5900, TotalTime: 562, Count: 3, MaxTime: 406, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libcrypto-3-x64.dll, EstimatedImpact: 100%
2026-08-01T22:23:06.641 ProcessImageName: RuntimeBroker.exe, Pid: 6732, TotalTime: 530, Count: 3, MaxTime: 500, MaxTimeFile: \Device\HarddiskVolume2\Program Files\FileZilla FTP Client\filezilla.exe, EstimatedImpact: 22%
2026-08-01T22:23:06.641 ProcessImageName: httpd.exe, Pid: 7616, TotalTime: 528, Count: 36, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\Rh34zwUdLnkgzypytg777Nd9IcA1vQ6nK6lH7_ze2ag, EstimatedImpact: 9%
2026-08-01T22:23:06.641 ProcessImageName: runonce.exe, Pid: 7404, TotalTime: 447, Count: 14, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 30%
2026-08-01T22:23:06.641 ProcessImageName: httpd.exe, Pid: 348, TotalTime: 419, Count: 7, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Apache24\modules\mod_headers.so, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: findstr.exe, Pid: 484, TotalTime: 322, Count: 25, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-autoindex.conf, EstimatedImpact: 89%
2026-08-01T22:23:06.641 ProcessImageName: mmc.exe, Pid: 4572, TotalTime: 308, Count: 16, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\c2f05f765d8b9324d606f711fe96f209\MIGUIControls.ni.dll, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: powershell.exe, Pid: 7356, TotalTime: 294, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 34%
2026-08-01T22:23:06.641 ProcessImageName: WmiPrvSE.exe, Pid: 7432, TotalTime: 294, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100%
2026-08-01T22:23:06.641 ProcessImageName: python.exe, Pid: 2956, TotalTime: 289, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\setuptools-69.0.2.dist-info\entry_points.txt, EstimatedImpact: 13%
2026-08-01T22:23:06.641 ProcessImageName: mmc.exe, Pid: 9088, TotalTime: 262, Count: 9, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\KZ3GNUWD\views[1], EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 260, Count: 16, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\spool\V4Dirs\2A69E168-833E-4BE0-9D9D-6E354AC311E8\merged.gpd, EstimatedImpact: 4%
2026-08-01T22:23:06.641 ProcessImageName: cmd.exe, Pid: 4580, TotalTime: 218, Count: 2, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\OpenSSL.exe, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: svchost.exe, Pid: 5220, TotalTime: 218, Count: 2, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\DO89A9.tmp, EstimatedImpact: 66%
2026-08-01T22:23:06.641 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 196, Count: 26, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2662-0.MAD, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: notepad.exe, Pid: 8636, TotalTime: 184, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\httpd.conf, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: httpd.exe, Pid: 3172, TotalTime: 171, Count: 12, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_noframes.html, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 168, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: ngentask.exe, Pid: 5804, TotalTime: 136, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 30%
2026-08-01T22:23:06.641 ProcessImageName: python.exe, Pid: 2920, TotalTime: 122, Count: 7, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\client.py, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: ngentask.exe, Pid: 700, TotalTime: 121, Count: 10, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 22%
2026-08-01T22:23:06.641 ProcessImageName: ngentask.exe, Pid: 6752, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-08-01T22:23:06.641 ProcessImageName: ngentask.exe, Pid: 4508, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 30%
2026-08-01T22:23:06.641 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: python.exe, Pid: 4068, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\accounts\acme-v02.api.letsencrypt.org\directory\612050855f7c1a31bed06818996045ed\regr.json, EstimatedImpact: 28%
2026-08-01T22:23:06.641 ProcessImageName: taskhostw.exe, Pid: 2248, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 16%
2026-08-01T22:23:06.641 ProcessImageName: notepad.exe, Pid: 8360, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: notepad.exe, Pid: 5768, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-vhosts.conf, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: tzsync.exe, Pid: 4380, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezoneMapping.xml->(UTF-8), EstimatedImpact: 45%
2026-08-01T22:23:06.641 ProcessImageName: svchost.exe, Pid: 2972, TotalTime: 61, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator.cdpresource, EstimatedImpact: 1%
2026-08-01T22:23:06.641 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: notepad.exe, Pid: 9076, TotalTime: 61, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: svchost.exe, Pid: 1360, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\prn0037.tmp, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: python.exe, Pid: 1792, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\.well-known\acme-challenge\web.config, EstimatedImpact: 2%
2026-08-01T22:23:06.641 ProcessImageName: python.exe, Pid: 8472, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\mamweb.at.conf, EstimatedImpact: 1%
2026-08-01T22:23:06.641 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 7348, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log, EstimatedImpact: 37%
2026-08-01T22:23:06.641 ProcessImageName: powershell.exe, Pid: 5788, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: httpd.exe, Pid: 9132, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Apache24\logs\httpd.pid.iUdTbW, EstimatedImpact: 0%
2026-08-01T22:23:06.641 ProcessImageName: powershell.exe, Pid: 8760, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 6%
2026-08-01T22:23:06.641 ProcessImageName: DismHost.exe, Pid: 6036, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{c76cbcad-afc9-11eb-8234-000d3aa6d50e}.TM.blf, EstimatedImpact: 2%
2026-08-01T22:23:06.641 ProcessImageName: python.exe, Pid: 9088, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\web.config, EstimatedImpact: 0%
2026-08-01T22:30:32.281 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T22:30:32.281 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T22:30:32.281 [Cloud] Queued cloud request.
2026-08-01T22:30:32.281 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T22:30:32.281 [Cloud] Dequeued cloud request.
2026-08-01T22:30:32.281 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T22:30:32.453 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E74147AB-1AB9-8A19-8C9A-5F11ECDCB4A4}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 22:30:32
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T22:30:32.953 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T22:31:19.766 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T22:31:19.766 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T22:31:19.766 [Cloud] Queued cloud request.
2026-08-01T22:31:19.766 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T22:31:19.766 [Cloud] Dequeued cloud request.
2026-08-01T22:31:19.766 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T22:31:19.859 [Cloud] End of cloud request.
2026-08-01T22:31:20.359 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T22:35:30.953 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8370415, FileId: 0x33a0000000633f4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:35:31.316 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_services_msc. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8370424, FileId: 0x1c000000037686, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:35:37.406 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T22:40:39.937 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-26e3-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372528, FileId: 0x200000000239e5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:39.937 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-26e3-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372529, FileId: 0x140000000239d3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:44.422 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-26f1-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372581, FileId: 0x90000000c4405, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:44.422 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-26f1-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372582, FileId: 0xb0000000c4404, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:49.953 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2723-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372677, FileId: 0x80000000c4410, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:49.953 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2723-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372678, FileId: 0x80000000c440f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:50.047 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2724-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372681, FileId: 0x90000000c4410, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:50.047 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2724-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372682, FileId: 0x90000000c440f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:50.359 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2725-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372686, FileId: 0xa0000000c4410, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:50.359 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2725-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372687, FileId: 0xa0000000c440f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:50.640 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2726-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372690, FileId: 0xb0000000c4410, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:50.640 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2726-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372691, FileId: 0xb0000000c440f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:50.656 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2727-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372695, FileId: 0xc0000000c4410, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:50.656 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2727-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372696, FileId: 0xc0000000c440f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:50.797 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-272e-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372702, FileId: 0xd0000000c4410, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:40:50.797 [RTP] [Mini-filter] Unsuccessful scan status(#27): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-272e-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8372703, FileId: 0xd0000000c440f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:19.656 [RTP] [Mini-filter] Unsuccessful scan status(#29): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2756-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8374883, FileId: 0x90000000c4416, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:19.656 [RTP] [Mini-filter] Unsuccessful scan status(#28): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2756-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8374882, FileId: 0x90000000c4417, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:20.406 [RTP] [Mini-filter] Unsuccessful scan status(#30): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2759-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8374896, FileId: 0xa0000000c4416, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:20.406 [RTP] [Mini-filter] Unsuccessful scan status(#31): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2759-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8374895, FileId: 0xa0000000c4417, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:20.859 [RTP] [Mini-filter] Unsuccessful scan status(#33): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-275a-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8374904, FileId: 0xb0000000c4417, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:20.859 [RTP] [Mini-filter] Unsuccessful scan status(#32): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-275a-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8374903, FileId: 0x80000000c4418, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:30.156 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T22:47:30.156 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T22:47:30.156 [Cloud] Queued cloud request.
2026-08-01T22:47:30.156 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T22:47:30.156 [Cloud] Dequeued cloud request.
2026-08-01T22:47:30.156 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T22:47:30.359 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{FB32DE5E-AB0D-63B6-4A7D-5F74DBE5DCEE}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 22:47:30
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T22:47:30.859 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T22:47:32.296 [RTP] [Mini-filter] Unsuccessful scan status(#35): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-277c-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8374993, FileId: 0x80000000c441a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:32.296 [RTP] [Mini-filter] Unsuccessful scan status(#34): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-277c-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8374992, FileId: 0x80000000c441b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:37.203 [RTP] [Mini-filter] Unsuccessful scan status(#37): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2793-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375031, FileId: 0x90000000c441a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:37.203 [RTP] [Mini-filter] Unsuccessful scan status(#36): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2793-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375030, FileId: 0x90000000c441b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:38.437 [RTP] [Mini-filter] Unsuccessful scan status(#39): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-279c-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375045, FileId: 0xa0000000c441a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:38.437 [RTP] [Mini-filter] Unsuccessful scan status(#38): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-279c-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375044, FileId: 0xa0000000c441b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:40.593 [RTP] [Mini-filter] Unsuccessful scan status(#40): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27a5-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375071, FileId: 0x80000000c441c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:40.593 [RTP] [Mini-filter] Unsuccessful scan status(#41): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27a5-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375072, FileId: 0xb0000000c441b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:42.140 [RTP] [Mini-filter] Unsuccessful scan status(#43): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27b0-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375095, FileId: 0x90000000c441c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:42.140 [RTP] [Mini-filter] Unsuccessful scan status(#42): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27b0-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375094, FileId: 0x70000000c441d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:47.218 [RTP] [Mini-filter] Unsuccessful scan status(#45): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27ca-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375165, FileId: 0x70000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:47.218 [RTP] [Mini-filter] Unsuccessful scan status(#44): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27ca-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375164, FileId: 0x70000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:48.609 [RTP] [Mini-filter] Unsuccessful scan status(#47): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27d2-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375179, FileId: 0x80000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:48.609 [RTP] [Mini-filter] Unsuccessful scan status(#46): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27d2-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375178, FileId: 0x80000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:48.703 [RTP] [Mini-filter] Unsuccessful scan status(#49): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27d3-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375184, FileId: 0x90000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:48.703 [RTP] [Mini-filter] Unsuccessful scan status(#48): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27d3-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375183, FileId: 0x90000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:49.296 [RTP] [Mini-filter] Unsuccessful scan status(#50): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27d5-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375192, FileId: 0xa0000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:49.296 [RTP] [Mini-filter] Unsuccessful scan status(#51): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27d5-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375193, FileId: 0xa0000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:49.421 [RTP] [Mini-filter] Unsuccessful scan status(#52): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27d7-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375196, FileId: 0xb0000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:49.421 [RTP] [Mini-filter] Unsuccessful scan status(#53): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27d7-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375197, FileId: 0xb0000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:50.328 [RTP] [Mini-filter] Unsuccessful scan status(#54): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27db-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375212, FileId: 0xc0000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:50.328 [RTP] [Mini-filter] Unsuccessful scan status(#55): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27db-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375213, FileId: 0xc0000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:50.328 [RTP] [Mini-filter] Unsuccessful scan status(#57): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27dc-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375217, FileId: 0xd0000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:50.328 [RTP] [Mini-filter] Unsuccessful scan status(#56): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27dc-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375216, FileId: 0xd0000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:51.062 [RTP] [Mini-filter] Unsuccessful scan status(#59): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27e0-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375224, FileId: 0xe0000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:51.062 [RTP] [Mini-filter] Unsuccessful scan status(#58): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27e0-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375223, FileId: 0xe0000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:51.374 [RTP] [Mini-filter] Unsuccessful scan status(#60): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27e1-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375232, FileId: 0xf0000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:51.374 [RTP] [Mini-filter] Unsuccessful scan status(#61): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27e1-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375233, FileId: 0xf0000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:51.843 [RTP] [Mini-filter] Unsuccessful scan status(#62): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27e5-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375238, FileId: 0x100000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:51.843 [RTP] [Mini-filter] Unsuccessful scan status(#63): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27e5-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375239, FileId: 0x100000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:52.671 [RTP] [Mini-filter] Unsuccessful scan status(#65): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27ea-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375250, FileId: 0x110000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:52.671 [RTP] [Mini-filter] Unsuccessful scan status(#64): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27ea-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375249, FileId: 0x110000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:53.609 [RTP] [Mini-filter] Unsuccessful scan status(#66): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27ed-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375261, FileId: 0x120000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:53.609 [RTP] [Mini-filter] Unsuccessful scan status(#67): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27ed-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375262, FileId: 0x120000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:54.468 [RTP] [Mini-filter] Unsuccessful scan status(#69): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27f4-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375272, FileId: 0x130000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:54.468 [RTP] [Mini-filter] Unsuccessful scan status(#68): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-27f4-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375271, FileId: 0x130000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:56.265 [RTP] [Mini-filter] Unsuccessful scan status(#71): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2800-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375292, FileId: 0x140000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:56.265 [RTP] [Mini-filter] Unsuccessful scan status(#70): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2800-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375291, FileId: 0x140000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:56.359 [RTP] [Mini-filter] Unsuccessful scan status(#73): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2801-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375298, FileId: 0x150000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:56.359 [RTP] [Mini-filter] Unsuccessful scan status(#72): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2801-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375297, FileId: 0x150000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:57.124 [RTP] [Mini-filter] Unsuccessful scan status(#75): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2805-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375305, FileId: 0x160000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:57.124 [RTP] [Mini-filter] Unsuccessful scan status(#74): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2805-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375304, FileId: 0x160000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:57.296 [RTP] [Mini-filter] Unsuccessful scan status(#76): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2807-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375311, FileId: 0x170000000c4421, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:47:57.296 [RTP] [Mini-filter] Unsuccessful scan status(#77): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2807-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375312, FileId: 0x170000000c4420, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:15.031 [RTP] [Mini-filter] Unsuccessful scan status(#79): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2858-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375554, FileId: 0x90000000c442e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:15.031 [RTP] [Mini-filter] Unsuccessful scan status(#78): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2858-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375553, FileId: 0x60000000c4430, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:17.734 [RTP] [Mini-filter] Unsuccessful scan status(#81): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2866-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375596, FileId: 0xa0000000c442e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:17.734 [RTP] [Mini-filter] Unsuccessful scan status(#80): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2866-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375595, FileId: 0x70000000c4430, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:34.171 [RTP] [Mini-filter] Unsuccessful scan status(#83): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-28bf-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375782, FileId: 0x60000000c4445, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:34.171 [RTP] [Mini-filter] Unsuccessful scan status(#82): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-28bf-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375781, FileId: 0x60000000c4446, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:35.109 [RTP] [Mini-filter] Unsuccessful scan status(#84): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-28c4-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375796, FileId: 0x70000000c4446, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:35.109 [RTP] [Mini-filter] Unsuccessful scan status(#85): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-28c4-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375797, FileId: 0x70000000c4445, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:35.812 [RTP] [Mini-filter] Unsuccessful scan status(#87): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-28ca-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375827, FileId: 0x90000000c4446, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:35.812 [RTP] [Mini-filter] Unsuccessful scan status(#86): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-28ca-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375826, FileId: 0x70000000c4447, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:36.484 [RTP] [Mini-filter] Unsuccessful scan status(#88): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-28d0-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375838, FileId: 0x70000000c4449, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:36.499 [RTP] [Mini-filter] Unsuccessful scan status(#89): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-28d0-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375839, FileId: 0x80000000c4447, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:38.140 [RTP] [Mini-filter] Unsuccessful scan status(#91): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-28da-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375859, FileId: 0x90000000c4447, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:38.140 [RTP] [Mini-filter] Unsuccessful scan status(#90): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-28da-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375858, FileId: 0x80000000c4449, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:38.953 [RTP] [Mini-filter] Unsuccessful scan status(#92): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-28df-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375870, FileId: 0x90000000c4449, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:48:38.953 [RTP] [Mini-filter] Unsuccessful scan status(#93): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-28df-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8375871, FileId: 0xa0000000c4447, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:50:31.359 [RTP] [Mini-filter] Unsuccessful scan status(#94): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2b95-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8377126, FileId: 0x130000000c447f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:50:31.359 [RTP] [Mini-filter] Unsuccessful scan status(#95): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2b95-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8377127, FileId: 0x120000000c447e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:50:42.406 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T22:53:10.406 [RTP] [Mini-filter] Unsuccessful scan status(#97): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2f4c-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8378689, FileId: 0x110000000c4495, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:53:10.406 [RTP] [Mini-filter] Unsuccessful scan status(#96): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-2f4c-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8378688, FileId: 0x110000000c449f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:56:34.593 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T22:56:34.593 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T22:56:34.593 [Cloud] Queued cloud request.
2026-08-01T22:56:34.593 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T22:56:34.593 [Cloud] Dequeued cloud request.
2026-08-01T22:56:34.593 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T22:56:34.796 [Cloud] End of cloud request.
2026-08-01T22:56:35.296 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x9bbabdf3
Internal signature match:subtype=Lowfi, sigseq=0x001107BD8A45AAC6, sigsha=5f443c7a99b8ca69580bdc91a5c96c381a4909ba, cached=false, source=2, resourceid=0x9bbabdf3

BEGIN BM telemetry
GUID:{35F1E8E1-7BE0-F65F-FF5C-BF6BD4C52F19}
SignatureID:55745256291477
SigSha:7106c73e392948e275190c3cff85a5401a98a8bc
ThreatLevel:0
ProcessID:4364
ProcessCreationTime:134300926691185095
SessionID:0
CreationTime:08-01-2026 22:58:02
ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T22:58:02.874 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpMyAdmin\support.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x3329faf726b1
2026-08-01T22:58:03.921 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T22:58:03.921 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T22:58:03.921 [Cloud] Queued cloud request.
2026-08-01T22:58:03.921 [Cloud] Dequeued cloud request.
2026-08-01T22:58:03.921 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T22:58:03.921 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\a9c1f5dc1252b1f95e1802ee0bc3295c5af92a67
Dynamic Signature Compilation Timestamp:08-01-2026 22:58:04
Persistence Type:Duration
Time remaining:288000000
2026-08-01T22:58:04.499 Dynamic signature received
2026-08-01T22:58:04.499 [Cloud] End of cloud request.
2026-08-01T22:58:04.999 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T22:59:53.702 [RTP] [Mini-filter] Unsuccessful scan status(#99): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-3876-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8382895, FileId: 0x490000000c44c6, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T22:59:53.702 [RTP] [Mini-filter] Unsuccessful scan status(#98): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-3876-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8382894, FileId: 0x3d0000000c44cc, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-01T23:05:47.405 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e
Internal signature match:subtype=Lowfi, sigseq=0x001107BD8A45AAC6, sigsha=5f443c7a99b8ca69580bdc91a5c96c381a4909ba, cached=false, source=2, resourceid=0xd681195e
2026-08-01T23:07:55.890 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c

BEGIN BM telemetry
GUID:{931E2594-25B6-7126-2DD9-4D302A89B92D}
SignatureID:55745797457393
SigSha:ddb4adac2aca8c16554162e265921a50721a9574
ThreatLevel:0
ProcessID:4364
ProcessCreationTime:134300926691185095
SessionID:0
CreationTime:08-01-2026 23:07:55
ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7
2026-08-01T23:07:55.921 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T23:07:55.921 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T23:07:55.921 [Cloud] Queued cloud request.
2026-08-01T23:07:55.921 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T23:07:55.921 [Cloud] Dequeued cloud request.
2026-08-01T23:07:55.921 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T23:07:56.437 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T23:07:56.437 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T23:07:56.437 [Cloud] Queued cloud request.
2026-08-01T23:07:56.437 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T23:07:56.437 [Cloud] Dequeued cloud request.
2026-08-01T23:07:56.452 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T23:07:56.468 [Cloud] SubmitReport(CMpBmSpyNetReportContext)
2026-08-01T23:07:56.468 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T23:07:56.468 [Cloud] Queued cloud request.
2026-08-01T23:07:56.468 [Cloud] Dequeued cloud request.
2026-08-01T23:07:56.468 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T23:07:56.499 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c
2026-08-01T23:07:56.499 [Cloud] End of cloud request.
2026-08-01T23:07:56.640 [Cloud] MpEngineParseSpyNetResponse(). hr = 0
2026-08-01T23:07:56.640 [Cloud] End of cloud request.
2026-08-01T23:07:56.921 [Cloud] End of cloud request.
2026-08-01T23:07:56.999 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T23:08:24.405 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T23:08:24.405 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T23:08:24.405 [Cloud] Queued cloud request.
2026-08-01T23:08:24.405 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T23:08:24.405 [Cloud] Dequeued cloud request.
2026-08-01T23:08:24.405 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T23:08:24.499 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{10D51B23-B023-7708-6BE0-3E64A69FDD24}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 23:08:24
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T23:08:24.999 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T23:19:05.655 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T23:19:05.655 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T23:19:05.655 [Cloud] Queued cloud request.
2026-08-01T23:19:05.655 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T23:19:05.655 [Cloud] Dequeued cloud request.
2026-08-01T23:19:05.655 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T23:19:05.811 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{A2F3C71C-0320-0B91-B35C-BDDFCBAD1D62}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 23:19:05
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T23:19:06.327 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T23:20:52.405 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T23:27:28.780 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T23:27:28.780 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T23:27:28.780 [Cloud] Queued cloud request.
2026-08-01T23:27:28.780 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T23:27:28.780 [Cloud] Dequeued cloud request.
2026-08-01T23:27:28.780 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T23:27:30.139 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1065BB66-E6BA-2BA2-51E1-5E544749CB5A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 23:27:30
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T23:27:30.639 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T23:35:57.405 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T23:37:32.327 [RTP] [Mini-filter] Unsuccessful scan status(#100): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-5b7d-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8401433, FileId: 0x90000000c482b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0

BEGIN BM telemetry
GUID:{89DA7ECC-348D-1A78-B21A-28ADDAD446B0}
SignatureID:340520518878414
SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0
ThreatLevel:0
ProcessID:4364
ProcessCreationTime:134300926691185095
SessionID:0
CreationTime:08-01-2026 23:40:20
ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T23:40:20.827 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T23:40:20.827 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T23:40:20.827 [Cloud] Queued cloud request.
2026-08-01T23:40:20.827 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T23:40:20.827 [Cloud] Dequeued cloud request.
2026-08-01T23:40:20.827 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T23:40:20.952 [Cloud] End of cloud request.
2026-08-01T23:40:21.452 [NRI] Successfully updated NIS service with platform settings for enforcement level Log

BEGIN BM telemetry
GUID:{B130C933-8652-AF7C-A7CD-40D9338CFB14}
SignatureID:55745797457393
SigSha:ddb4adac2aca8c16554162e265921a50721a9574
ThreatLevel:0
ProcessID:4044
ProcessCreationTime:134301013046258333
SessionID:0
CreationTime:08-01-2026 23:41:44
ImagePath:C:\Windows\SysWOW64\cmd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe:4364:1,
Operations:None
END BM telemetry

2026-08-01T23:41:45.780 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T23:41:45.780 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T23:41:45.780 [Cloud] Queued cloud request.
2026-08-01T23:41:45.780 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T23:41:45.780 [Cloud] Dequeued cloud request.
2026-08-01T23:41:45.780 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T23:41:45.936 [Cloud] End of cloud request.
2026-08-01T23:41:46.452 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T23:41:46.702 Bm signature throttled:0x000032b3547485f1
2026-08-01T23:41:48.467 Bm signature throttled:0x000032b3547485f1
2026-08-01T23:42:33.155 Bm signature throttled:0x000032b3547485f1
2026-08-01T23:42:35.061 Bm signature throttled:0x000032b3547485f1
2026-08-01T23:42:36.795 Bm signature throttled:0x000032b3547485f1
2026-08-01T23:51:02.405 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-01T23:51:38.451 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T23:51:38.451 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T23:51:38.451 [Cloud] Queued cloud request.
2026-08-01T23:51:38.451 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T23:51:38.451 [Cloud] Dequeued cloud request.
2026-08-01T23:51:38.451 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T23:51:38.639 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{30421E50-10BE-5090-C74A-F829400D5379}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 23:51:38
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T23:51:39.139 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-01T23:56:21.201 Bm signature throttled:0x000032b3547485f1
2026-08-01T23:57:16.498 Bm signature throttled:0x000032b3547485f1
2026-08-01T23:57:46.998 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-01T23:57:46.998 [Cloud] Start of cloud request. Passive mode: 0
2026-08-01T23:57:46.998 [Cloud] Queued cloud request.
2026-08-01T23:57:46.998 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-01T23:57:46.998 [Cloud] Dequeued cloud request.
2026-08-01T23:57:46.998 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-01T23:57:47.186 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{5D140831-33FD-1F80-770E-E2C61866F4D7}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-01-2026 23:57:47
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-01T23:57:47.686 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T00:06:07.404 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T00:06:59.779 Bm signature throttled:0x000032b3547485f1
2026-08-02T00:07:01.857 Bm signature throttled:0x000032b3547485f1
2026-08-02T00:07:05.045 Bm signature throttled:0x000032b3547485f1
2026-08-02T00:07:10.529 Bm signature throttled:0x000032b3547485f1
2026-08-02T00:07:13.170 Bm signature throttled:0x000032b3547485f1
2026-08-02T00:07:17.014 Bm signature throttled:0x000032b3547485f1
2026-08-02T00:11:23.904 Bm signature throttled:0x000032b3547485f1
2026-08-02T00:12:20.763 Bm signature throttled:0x000032b3547485f1
2026-08-02T00:19:27.013 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T00:19:27.013 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T00:19:27.013 [Cloud] Queued cloud request.
2026-08-02T00:19:27.013 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T00:19:27.013 [Cloud] Dequeued cloud request.
2026-08-02T00:19:27.013 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T00:19:27.185 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{00CFD511-2B38-CEF4-7B0F-9D773A23C4C8}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 00:19:27
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T00:19:27.685 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T00:21:12.404 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T00:23:06.654 ProcessImageName: httpd.exe, Pid: 4364, TotalTime: 374490, Count: 26849, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 3%
2026-08-02T00:23:06.654 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 19646, Count: 994, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: httpd.exe, Pid: 4916, TotalTime: 6548, Count: 354, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\googlemaps\Wienerberg_20050613.html->(SCRIPT0002), EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: explorer.exe, Pid: 3232, TotalTime: 5892, Count: 312, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: explorer.exe, Pid: 5148, TotalTime: 2871, Count: 45, MaxTime: 656, MaxTimeFile: \Device\HarddiskVolume2\nginx\nginx.exe, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: explorer.exe, Pid: 4500, TotalTime: 2064, Count: 145, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$IAGSLW9.php, EstimatedImpact: 75%
2026-08-02T00:23:06.654 ProcessImageName: powershell.exe, Pid: 9088, TotalTime: 1977, Count: 90, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\000a53285985b0def7f9930691f067ae\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 35%
2026-08-02T00:23:06.654 ProcessImageName: httpd.exe, Pid: 4344, TotalTime: 1248, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libhttpd.dll, EstimatedImpact: 74%
2026-08-02T00:23:06.654 ProcessImageName: httpd.exe, Pid: 7652, TotalTime: 963, Count: 73, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\sPHDG69Fsq42ArEA9e-xxABuiC5BbJ9i8japwI9iric, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: AgentShellSystemTray.exe, Pid: 2184, TotalTime: 895, Count: 34, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 33%
2026-08-02T00:23:06.654 ProcessImageName: httpd.exe, Pid: 8796, TotalTime: 893, Count: 21, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\PHP53\ext\ioncube_loader_win_5.3.dll, EstimatedImpact: 53%
2026-08-02T00:23:06.654 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 813, Count: 142, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-26f1-0.MAI, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 794, Count: 39, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: dllhost.exe, Pid: 4576, TotalTime: 744, Count: 54, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: WmiPrvSE.exe, Pid: 7884, TotalTime: 722, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 13%
2026-08-02T00:23:06.654 ProcessImageName: explorer.exe, Pid: 1100, TotalTime: 700, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$I30CG93, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: httpd.exe, Pid: 3452, TotalTime: 635, Count: 13, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php5ts.dll, EstimatedImpact: 96%
2026-08-02T00:23:06.654 ProcessImageName: powershell.exe, Pid: 3424, TotalTime: 634, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\b96f467c2d8ead8ce81b4cdd1f08846e\System.Management.Automation.ni.dll, EstimatedImpact: 20%
2026-08-02T00:23:06.654 ProcessImageName: WmiPrvSE.exe, Pid: 3116, TotalTime: 577, Count: 39, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 42%
2026-08-02T00:23:06.654 ProcessImageName: openssl.exe, Pid: 5900, TotalTime: 562, Count: 3, MaxTime: 406, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libcrypto-3-x64.dll, EstimatedImpact: 100%
2026-08-02T00:23:06.654 ProcessImageName: RuntimeBroker.exe, Pid: 6732, TotalTime: 530, Count: 3, MaxTime: 500, MaxTimeFile: \Device\HarddiskVolume2\Program Files\FileZilla FTP Client\filezilla.exe, EstimatedImpact: 22%
2026-08-02T00:23:06.654 ProcessImageName: httpd.exe, Pid: 7616, TotalTime: 528, Count: 36, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\Rh34zwUdLnkgzypytg777Nd9IcA1vQ6nK6lH7_ze2ag, EstimatedImpact: 9%
2026-08-02T00:23:06.654 ProcessImageName: runonce.exe, Pid: 7404, TotalTime: 447, Count: 14, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 30%
2026-08-02T00:23:06.654 ProcessImageName: httpd.exe, Pid: 348, TotalTime: 419, Count: 7, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Apache24\modules\mod_headers.so, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: findstr.exe, Pid: 484, TotalTime: 322, Count: 25, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-autoindex.conf, EstimatedImpact: 89%
2026-08-02T00:23:06.654 ProcessImageName: mmc.exe, Pid: 4572, TotalTime: 308, Count: 16, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\c2f05f765d8b9324d606f711fe96f209\MIGUIControls.ni.dll, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: powershell.exe, Pid: 7356, TotalTime: 294, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 34%
2026-08-02T00:23:06.654 ProcessImageName: WmiPrvSE.exe, Pid: 7432, TotalTime: 294, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100%
2026-08-02T00:23:06.654 ProcessImageName: python.exe, Pid: 2956, TotalTime: 289, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\setuptools-69.0.2.dist-info\entry_points.txt, EstimatedImpact: 13%
2026-08-02T00:23:06.654 ProcessImageName: mmc.exe, Pid: 9088, TotalTime: 262, Count: 9, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\KZ3GNUWD\views[1], EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 260, Count: 16, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\spool\V4Dirs\2A69E168-833E-4BE0-9D9D-6E354AC311E8\merged.gpd, EstimatedImpact: 4%
2026-08-02T00:23:06.654 ProcessImageName: cmd.exe, Pid: 4580, TotalTime: 218, Count: 2, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\OpenSSL.exe, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: svchost.exe, Pid: 5220, TotalTime: 218, Count: 2, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\DO89A9.tmp, EstimatedImpact: 66%
2026-08-02T00:23:06.654 ProcessImageName: notepad.exe, Pid: 8636, TotalTime: 184, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\httpd.conf, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 183, Count: 9, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: httpd.exe, Pid: 3172, TotalTime: 171, Count: 12, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_noframes.html, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: ngentask.exe, Pid: 5804, TotalTime: 136, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 30%
2026-08-02T00:23:06.654 ProcessImageName: python.exe, Pid: 2920, TotalTime: 122, Count: 7, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\client.py, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: ngentask.exe, Pid: 700, TotalTime: 121, Count: 10, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 22%
2026-08-02T00:23:06.654 ProcessImageName: ngentask.exe, Pid: 6752, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-08-02T00:23:06.654 ProcessImageName: ngentask.exe, Pid: 4508, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 30%
2026-08-02T00:23:06.654 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: python.exe, Pid: 4068, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\accounts\acme-v02.api.letsencrypt.org\directory\612050855f7c1a31bed06818996045ed\regr.json, EstimatedImpact: 28%
2026-08-02T00:23:06.654 ProcessImageName: taskhostw.exe, Pid: 2248, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 16%
2026-08-02T00:23:06.654 ProcessImageName: notepad.exe, Pid: 8360, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: notepad.exe, Pid: 5768, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-vhosts.conf, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: tzsync.exe, Pid: 4380, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezoneMapping.xml->(UTF-8), EstimatedImpact: 45%
2026-08-02T00:23:06.654 ProcessImageName: svchost.exe, Pid: 2972, TotalTime: 61, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator.cdpresource, EstimatedImpact: 1%
2026-08-02T00:23:06.654 ProcessImageName: notepad.exe, Pid: 9076, TotalTime: 61, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: svchost.exe, Pid: 1360, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\prn0037.tmp, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: python.exe, Pid: 1792, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\.well-known\acme-challenge\web.config, EstimatedImpact: 2%
2026-08-02T00:23:06.654 ProcessImageName: python.exe, Pid: 8472, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\mamweb.at.conf, EstimatedImpact: 1%
2026-08-02T00:23:06.654 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 7348, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log, EstimatedImpact: 37%
2026-08-02T00:23:06.654 ProcessImageName: powershell.exe, Pid: 5788, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: httpd.exe, Pid: 9132, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Apache24\logs\httpd.pid.iUdTbW, EstimatedImpact: 0%
2026-08-02T00:23:06.654 ProcessImageName: powershell.exe, Pid: 8760, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 6%
2026-08-02T00:23:06.654 ProcessImageName: DismHost.exe, Pid: 6036, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{c76cbcad-afc9-11eb-8234-000d3aa6d50e}.TM.blf, EstimatedImpact: 2%
2026-08-02T00:23:06.654 ProcessImageName: python.exe, Pid: 9088, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\web.config, EstimatedImpact: 0%
2026-08-02T00:27:41.763 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T00:27:41.763 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T00:27:41.763 [Cloud] Queued cloud request.
2026-08-02T00:27:41.763 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T00:27:41.763 [Cloud] Dequeued cloud request.
2026-08-02T00:27:41.763 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T00:27:41.919 [Cloud] End of cloud request.
2026-08-02T00:27:42.419 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T00:34:17.607 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T00:34:17.607 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T00:34:17.607 [Cloud] Queued cloud request.
2026-08-02T00:34:17.607 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T00:34:17.607 [Cloud] Dequeued cloud request.
2026-08-02T00:34:17.607 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T00:34:17.779 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{94B2EF79-EE60-9CA3-57B9-1D8451CE283D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 00:34:17
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T00:34:18.295 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T00:35:20.779 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T00:35:20.779 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T00:35:20.779 [Cloud] Queued cloud request.
2026-08-02T00:35:20.779 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T00:35:20.779 [Cloud] Dequeued cloud request.
2026-08-02T00:35:20.794 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T00:35:20.935 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{752CB534-B140-1F9E-FE3F-EAD9454D2553}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 00:35:20
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T00:35:21.435 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T00:36:17.404 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x56d96c17
Internal signature match:subtype=Lowfi, sigseq=0x001107BD8A45AAC6, sigsha=5f443c7a99b8ca69580bdc91a5c96c381a4909ba, cached=false, source=2, resourceid=0x56d96c17
2026-08-02T00:43:39.872 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpMyAdmin\tbl_changer.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x3329faf726b1
2026-08-02T00:46:33.607 Bm signature throttled:0x000032b3547485f1
2026-08-02T00:46:44.825 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:EA1A51C0-4BA9-40E3-BEEE-3C661FB55415, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1)
2026-08-02T00:46:44.825 Scheduled scan with Id EA1A51C0-4BA9-40E3-BEEE-3C661FB55415 configured CPU priority: normal (LowCpuPriority: 0)
2026-08-02T00:46:44.841 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build.
2026-08-02T00:46:44.841 [SFC] System file cache build is not needed (already completed)
2026-08-02T00:47:12.810 Engine:Triggered AR EMS scan

2026-08-02T00:47:12.825 Engine:EMS scan for process: lsass pid: 628, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.857 Engine:EMS scan for process: svchost pid: 744, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.872 Engine:EMS scan for process: svchost pid: 848, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.872 Engine:EMS scan for process: svchost pid: 916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.872 Engine:EMS scan for process: svchost pid: 988, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.903 Engine:EMS scan for process: svchost pid: 1008, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.903 Engine:EMS scan for process: svchost pid: 472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.919 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.919 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.935 Engine:EMS scan for process: svchost pid: 1104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.935 Engine:EMS scan for process: svchost pid: 1264, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.935 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.935 Engine:EMS scan for process: svchost pid: 1360, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.950 Engine:EMS scan for process: svchost pid: 1380, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.950 Engine:EMS scan for process: svchost pid: 1388, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.950 Engine:EMS scan for process: svchost pid: 1432, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.966 Engine:EMS scan for process: svchost pid: 1440, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.982 Engine:EMS scan for process: svchost pid: 1464, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.982 Engine:EMS scan for process: svchost pid: 1504, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.997 Engine:EMS scan for process: svchost pid: 1756, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.997 Engine:EMS scan for process: svchost pid: 1808, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:12.997 Engine:EMS scan for process: svchost pid: 1820, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.013 Engine:EMS scan for process: svchost pid: 1836, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.013 Engine:EMS scan for process: svchost pid: 1892, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.013 Engine:EMS scan for process: svchost pid: 1956, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.013 Engine:EMS scan for process: svchost pid: 2020, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.028 Engine:EMS scan for process: svchost pid: 2028, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.028 Engine:EMS scan for process: svchost pid: 1460, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.044 Engine:EMS scan for process: svchost pid: 1532, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.044 Engine:EMS scan for process: svchost pid: 2120, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.060 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.060 Engine:EMS scan for process: svchost pid: 2384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.075 Engine:EMS scan for process: svchost pid: 2496, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.075 Engine:EMS scan for process: svchost pid: 2512, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.075 Engine:EMS scan for process: svchost pid: 2532, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.091 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.091 Engine:EMS scan for process: svchost pid: 2560, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.107 Engine:EMS scan for process: svchost pid: 2620, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.107 Engine:EMS scan for process: svchost pid: 2632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.107 Engine:EMS scan for process: svchost pid: 2936, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.122 Engine:EMS scan for process: svchost pid: 3016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.122 Engine:EMS scan for process: svchost pid: 3056, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.138 Engine:EMS scan for process: svchost pid: 3128, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.138 Engine:EMS scan for process: svchost pid: 3176, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.138 Engine:EMS scan for process: svchost pid: 3236, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.153 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.153 Engine:EMS scan for process: svchost pid: 3364, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.153 Engine:EMS scan for process: svchost pid: 3184, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.169 Engine:EMS scan for process: dllhost pid: 4116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.169 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.185 Engine:EMS scan for process: svchost pid: 3432, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.200 Engine:EMS scan for process: svchost pid: 4860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.216 Engine:EMS scan for process: svchost pid: 1772, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.216 Engine:EMS scan for process: svchost pid: 1112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.232 Engine:EMS scan for process: svchost pid: 1496, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.247 Engine:EMS scan for process: svchost pid: 5320, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.263 Engine:EMS scan for process: svchost pid: 2444, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.278 Engine:EMS scan for process: svchost pid: 3068, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.294 Engine:EMS scan for process: svchost pid: 7360, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.310 Engine:EMS scan for process: svchost pid: 5256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.325 Engine:EMS scan for process: svchost pid: 5588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.341 Engine:EMS scan for process: svchost pid: 1680, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
2026-08-02T00:47:13.341 Engine:EMS scan for process: svchost pid: 6700, sigseq: 0x0, sendMemoryScanReport: 0, source: 1
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
2026-08-02T00:47:57.591 QuickScan:ScanID:EA1A51C0-4BA9-40E3-BEEE-3C661FB55415: Quick scan finished with error 0
2026-08-02T00:47:57.606 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T00:47:57.606 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T00:47:57.606 [Cloud] Queued cloud request.
2026-08-02T00:47:57.606 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T00:47:57.606 [Cloud] Dequeued cloud request.
2026-08-02T00:47:57.606 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T00:47:57.763 [Cloud] End of cloud request.
2026-08-02T00:47:57.763 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xe6d2f6467ffffffe
2026-08-02T00:47:57.763 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xa719dd6a7ffffffe
2026-08-02T00:47:57.778 UnknownTelemetryScan triggered, type: 2 (1 - Unknown, 2- Lofi), flags: 0 (0 - Regular, 1 - MemScan), 1 resources, RtpIoavOnly: FALSE
2026-08-02T00:47:57.778 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xe6d2f6467ffffffe
2026-08-02T00:47:57.778 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xa719dd6a7ffffffe
2026-08-02T00:47:58.278 [RTP] [RtpConfig] Config change detected, type: 32
2026-08-02T00:47:58.278 [RTP] Duplicating the current plugin configuration object...
2026-08-02T00:47:58.278 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ...
2026-08-02T00:47:58.278 [RTP] Updating plugin configuration due to recent config changes (0x20) ...
2026-08-02T00:47:58.278 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-02T00:47:58.278 [RTP] No config change detected. Not updating plugin configuration.
2026-08-02T00:47:58.278 [RTP] No config changes found. No configuration switch.
2026-08-02T00:47:58.278 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0
2026-08-02T00:47:58.278 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0xc9ecaca0
2026-08-02T00:48:00.763 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xe6d2f6467ffffffe
2026-08-02T00:48:00.763 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xe6d2f6467ffffffe
2026-08-02T00:48:00.778 [Cloud] SubmitReport(CMpUnknownSpyNetReportContext)
2026-08-02T00:48:00.778 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T00:48:00.778 [Cloud] Queued cloud request.
2026-08-02T00:48:00.778 [Cloud] Dequeued cloud request.
2026-08-02T00:48:00.794 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T00:48:00.841 [Cloud] MpEngineParseSpyNetResponse(). hr = 0
2026-08-02T00:48:00.841 [Cloud] End of cloud request.
2026-08-02T00:48:01.341 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T00:48:11.341 Bm signature throttled:0x000032b3547485f1
2026-08-02T00:48:14.325 Bm signature throttled:0x000032b3547485f1
2026-08-02T00:48:15.763 UnknownTelemetryScan triggered, type: 2 (1 - Unknown, 2- Lofi), flags: 0 (0 - Regular, 1 - MemScan), 1 resources, RtpIoavOnly: FALSE
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=0, resourceid=0x36a378cb
2026-08-02T00:48:18.294 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xa719dd6a7ffffffe
2026-08-02T00:48:18.294 Using signature default action MP_THREAT_ACTION_ALLOW(6) for special threatID: 0xa719dd6a7ffffffe
2026-08-02T00:48:18.325 [Cloud] SubmitReport(CMpUnknownSpyNetReportContext)
2026-08-02T00:48:18.325 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T00:48:18.325 [Cloud] Queued cloud request.
2026-08-02T00:48:18.325 [Cloud] Dequeued cloud request.
2026-08-02T00:48:18.341 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T00:48:18.372 [Cloud] MpEngineParseSpyNetResponse(). hr = 0
2026-08-02T00:48:18.372 [Cloud] End of cloud request.
2026-08-02T00:48:18.888 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T00:49:00.075 Bm signature throttled:0x000032b3547485f1
2026-08-02T00:51:22.403 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T00:56:37.513 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T00:56:37.513 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T00:56:37.513 [Cloud] Queued cloud request.
2026-08-02T00:56:37.513 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T00:56:37.513 [Cloud] Dequeued cloud request.
2026-08-02T00:56:37.513 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T00:56:37.700 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{19C0AD2E-FE13-BD11-8966-2528CA627874}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 00:56:37
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T00:56:38.216 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T00:59:36.403 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T00:59:36.403 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T00:59:36.403 [Cloud] Queued cloud request.
2026-08-02T00:59:36.403 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T00:59:36.403 [Cloud] Dequeued cloud request.
2026-08-02T00:59:36.403 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T00:59:36.591 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{91928582-1F53-3CD8-31B6-D391FEBCD0A7}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 00:59:36
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T00:59:37.106 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T01:00:02.169 [RTP] [Mini-filter] Unsuccessful scan status(#110): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-6115-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8440145, FileId: 0xf0000000c4d1e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T01:00:02.231 [RTP] [Mini-filter] Unsuccessful scan status(#120): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-6115-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8440175, FileId: 0x190000000c4d1e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T01:02:55.309 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T01:02:55.309 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T01:02:55.309 [Cloud] Queued cloud request.
2026-08-02T01:02:55.309 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T01:02:55.309 [Cloud] Dequeued cloud request.
2026-08-02T01:02:55.309 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T01:02:55.497 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{C7DD7192-489A-B691-BA85-2B78F55935C2}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 01:02:55
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T01:02:56.012 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T01:06:09.809 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T01:06:09.809 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T01:06:09.809 [Cloud] Queued cloud request.
2026-08-02T01:06:09.809 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T01:06:09.809 [Cloud] Dequeued cloud request.
2026-08-02T01:06:09.809 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T01:06:10.012 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{770C0451-EE39-00CD-A2A0-CCF288277E24}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 01:06:10
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T01:06:10.512 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T01:06:27.403 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T01:12:30.825 Bm signature throttled:0x000032b3547485f1
2026-08-02T01:13:14.106 Bm signature throttled:0x000032b3547485f1
2026-08-02T01:14:39.340 [RTP] [Mini-filter] Unsuccessful scan status(#130): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-64dc-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8446871, FileId: 0x80000000c4d3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T01:17:08.700 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T01:17:08.700 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T01:17:08.700 [Cloud] Queued cloud request.
2026-08-02T01:17:08.700 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T01:17:08.700 [Cloud] Dequeued cloud request.
2026-08-02T01:17:08.700 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T01:17:08.856 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{25EE259F-E277-34DF-2BAE-4EB17FC65F5B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 01:17:08
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T01:17:09.356 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T01:21:31.543 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T01:21:31.543 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T01:21:31.543 [Cloud] Queued cloud request.
2026-08-02T01:21:31.543 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T01:21:31.543 [Cloud] Dequeued cloud request.
2026-08-02T01:21:31.543 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{99DB5C2E-230C-D5CC-FBC4-A00680B27020}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 01:21:31
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T01:21:31.715 [Cloud] End of cloud request.
2026-08-02T01:21:32.215 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T01:21:32.403 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T01:23:22.043 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T01:23:22.043 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T01:23:22.043 [Cloud] Queued cloud request.
2026-08-02T01:23:22.043 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T01:23:22.043 [Cloud] Dequeued cloud request.
2026-08-02T01:23:22.043 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T01:23:22.231 [Cloud] End of cloud request.
2026-08-02T01:23:22.731 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T01:25:34.793 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T01:25:34.793 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T01:25:34.793 [Cloud] Queued cloud request.
2026-08-02T01:25:34.793 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T01:25:34.793 [Cloud] Dequeued cloud request.
2026-08-02T01:25:34.793 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T01:25:34.949 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{5822C29E-016C-C2F9-4B88-9376847A45A7}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 01:25:34
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T01:25:35.465 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T01:26:35.590 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T01:26:35.590 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T01:26:35.590 [Cloud] Queued cloud request.
2026-08-02T01:26:35.590 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T01:26:35.590 [Cloud] Dequeued cloud request.
2026-08-02T01:26:35.590 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T01:26:35.746 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E23EB561-CBE9-C5FC-A9AD-35C2BDE1D730}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 01:26:35
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T01:26:36.262 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T01:36:37.402 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T01:43:27.887 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T01:43:27.887 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T01:43:27.887 [Cloud] Queued cloud request.
2026-08-02T01:43:27.887 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T01:43:27.887 [Cloud] Dequeued cloud request.
2026-08-02T01:43:27.887 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T01:43:28.090 [Cloud] End of cloud request.
2026-08-02T01:43:28.590 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T01:46:28.543 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T01:46:28.543 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T01:46:28.543 [Cloud] Queued cloud request.
2026-08-02T01:46:28.543 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T01:46:28.543 [Cloud] Dequeued cloud request.
2026-08-02T01:46:28.543 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T01:46:28.730 [Cloud] End of cloud request.
2026-08-02T01:46:29.230 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T01:51:42.402 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T01:51:58.168 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T01:51:58.168 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T01:51:58.168 [Cloud] Queued cloud request.
2026-08-02T01:51:58.168 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T01:51:58.168 [Cloud] Dequeued cloud request.
2026-08-02T01:51:58.168 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{8339C875-62A4-E769-0887-25963D91AB73}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 01:51:58
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T01:51:58.371 [Cloud] End of cloud request.
2026-08-02T01:51:58.871 [NRI] Successfully updated NIS service with platform settings for enforcement level Log

BEGIN BM telemetry
GUID:{5DD9E66E-119A-ED55-DBBE-FC9D651F8D29}
SignatureID:55745797457393
SigSha:ddb4adac2aca8c16554162e265921a50721a9574
ThreatLevel:0
ProcessID:9036
ProcessCreationTime:134301093938266505
SessionID:0
CreationTime:08-02-2026 01:56:34
ImagePath:C:\Windows\SysWOW64\cmd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe:4364:3,C:\Windows\System32\csrss.exe:404:2,
Operations:None
END BM telemetry

2026-08-02T01:56:34.621 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T01:56:34.621 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T01:56:34.621 [Cloud] Queued cloud request.
2026-08-02T01:56:34.621 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T01:56:34.621 [Cloud] Dequeued cloud request.
2026-08-02T01:56:34.621 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T01:56:35.058 [Cloud] End of cloud request.
2026-08-02T01:56:35.558 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T01:56:36.433 Bm signature throttled:0x000032b3547485f1
2026-08-02T01:56:45.964 Bm signature throttled:0x000032b3547485f1
2026-08-02T01:56:47.793 Bm signature throttled:0x000032b3547485f1
2026-08-02T01:58:12.058 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T01:58:12.058 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T01:58:12.058 [Cloud] Queued cloud request.
2026-08-02T01:58:12.058 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T01:58:12.058 [Cloud] Dequeued cloud request.
2026-08-02T01:58:12.058 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T01:58:12.246 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{BF76CD8C-C7C5-1BA1-B139-95BEACCCCE6C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 01:58:12
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T01:58:12.746 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T01:59:44.449 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T01:59:44.449 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T01:59:44.449 [Cloud] Queued cloud request.
2026-08-02T01:59:44.449 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T01:59:44.449 [Cloud] Dequeued cloud request.
2026-08-02T01:59:44.449 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T01:59:44.621 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{5FED4104-67C7-524B-3FB7-A234B9509C81}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 01:59:44
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T01:59:45.121 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T02:00:06.777 [RTP] [Mini-filter] Unsuccessful scan status(#140): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-9083-9.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8467367, FileId: 0xc0000000c4d7c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:01:29.167 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T02:01:29.167 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T02:01:29.167 [Cloud] Queued cloud request.
2026-08-02T02:01:29.167 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T02:01:29.167 [Cloud] Dequeued cloud request.
2026-08-02T02:01:29.167 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T02:01:29.355 [Cloud] End of cloud request.
2026-08-02T02:01:29.871 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T02:01:59.292 [RTP] [Mini-filter] Unsuccessful scan status(#150): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-90a9-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8468394, FileId: 0xf0000000c4d7d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:06:47.402 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T02:12:26.605 [AutoPurge] Routine task for Cache Maintenance has started.
2026-08-02T02:12:26.620 [AutoPurge] Routine task for Cache Maintenance ...
2026-08-02T02:12:26.620 [AutoPurge] Routine task for MpSFCBuild ...
2026-08-02T02:12:26.620 [AutoPurge] MpCmIsBuildCompleted() - S_OK
2026-08-02T02:12:26.620 [AutoPurge] MpSignalMaintenanceMode ...
2026-08-02T02:12:26.620 [AutoPurge] Cleanup Routine tasks have started.
2026-08-02T02:12:26.620 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set.
2026-08-02T02:12:26.636 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0)
2026-08-02T02:12:26.636 [AutoPurge] Purged 0 expired detection item(s) from a total of 0.
2026-08-02T02:12:26.636 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 3, expiration in 86400 seconds)
Beginning quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Target:
Flags:65538
Start time:08-02-2026 02:12:26
Finished quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Result:0
End time:08-02-2026 02:12:26
2026-08-02T02:12:26.652 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ...
2026-08-02T02:12:26.652 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26060.3008-0 ...
2026-08-02T02:12:26.652 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26050.15-0 ...
2026-08-02T02:12:26.652 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26040.7-0 ...
2026-08-02T02:12:26.652 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ...
2026-08-02T02:12:26.652 [AutoPurge] Cleanup Routine tasks have ended.
2026-08-02T02:12:26.823 EnsureProtectedFolderAcls(), hr = 0x0
2026-08-02T02:12:26.839 [AutoPurge] MpReinforceServiceAcls: 0
2026-08-02T02:12:26.855 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0
2026-08-02T02:12:27.214 Job Notification: New process added to job (2712)
2026-08-02T02:12:27.214 Task(GetDeviceTicket -AccessKey 5F4052D0-8543-5E36-6A5F-FD558595005E ) launched as network service
2026-08-02T02:12:27.823 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\system32\mtf.dll", hr=0x0
2026-08-02T02:12:27.902 Job Notification: Process exited from job (2712)
2026-08-02T02:12:27.948 Engine:Setting original file name "comdlg32.dll" for "c:\windows\systemresources\comdlg32.dll.mun", hr=0x0
2026-08-02T02:12:27.980 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0
2026-08-02T02:12:28.058 [RTP] [Mini-filter] MpQueryRuntimeDrivers called. bytesToCopy = 36, ntStatus = 0xc0000023
2026-08-02T02:12:28.058 [RTP] [Mini-filter] MpQueryRuntimeDrivers called. bytesToCopy = 34728, ntStatus = 0x0
2026-08-02T02:12:28.089 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T02:12:28.089 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T02:12:28.089 [Cloud] Queued cloud request.
2026-08-02T02:12:28.089 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T02:12:28.089 [Cloud] Dequeued cloud request.
2026-08-02T02:12:28.089 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0
2026-08-02T02:12:28.089 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T02:12:28.089 [Cloud] Queued cloud request.
2026-08-02T02:12:28.089 [AutoPurge] Removing expired default signature package ...
2026-08-02T02:12:28.089 [Cloud] Dequeued cloud request.
2026-08-02T02:12:28.089 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T02:12:28.105 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T02:12:28.277 [Cloud] End of cloud request.
2026-08-02T02:12:28.304 [Cloud] MpEngineParseSpyNetResponse(). hr = 0
2026-08-02T02:12:28.308 [Cloud] End of cloud request.
2026-08-02T02:12:28.404 Job Notification: New process added to job (6656)
2026-08-02T02:12:28.620 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ...
2026-08-02T02:12:28.636 [RTP] [RtpConfig] Config change detected, type: 32
2026-08-02T02:12:28.636 [RTP] [RtpConfig] Config change detected, type: 2
2026-08-02T02:12:28.636 [RTP] [RtpConfig] Config change detected, type: 4096
2026-08-02T02:12:28.636 [RTP] [RtpConfig] Config change detected, type: 4
2026-08-02T02:12:28.636 [RTP] [RtpConfig] Config change detected, type: 8
2026-08-02T02:12:28.636 [RTP] [RtpConfig] Config change detected, type: 16
2026-08-02T02:12:28.636 [RTP] [RtpConfig] Config change detected, type: 1024
2026-08-02T02:12:28.636 [RTP] [RtpConfig] Config change detected, type: 2048
2026-08-02T02:12:28.636 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0).
2026-08-02T02:12:28.636 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0).
2026-08-02T02:12:28.636 [RTP] Setting FilterExperimentMode to 0 (hr=0).
2026-08-02T02:12:28.636 [RTP] Setting DisableDriverUnload to 1 (hr=0).
2026-08-02T02:12:28.636 [RTP] Setting RegLinkHardeningMode to 1 (hr=0).
2026-08-02T02:12:28.636 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0).
2026-08-02T02:12:28.636 [RTP] Setting EfsHardeningFlags to 0 (hr=0).
2026-08-02T02:12:28.636 [RTP] PreventPagingFileAbuseKillbit[0].
2026-08-02T02:12:28.636 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0).
2026-08-02T02:12:28.636 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0).
2026-08-02T02:12:28.636 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration.
2026-08-02T02:12:28.636 [RTP] [RtpConfig] Config change detected, type: 64
2026-08-02T02:12:28.636 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T02:12:28.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T02:12:28.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T02:12:28.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T02:12:28.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T02:12:28.933 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0
2026-08-02T02:12:29.417 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0
2026-08-02T02:12:29.495 Job Notification: Process exited from job (6656)
2026-08-02T02:12:29.558 [AutoPurge] Verification Routine tasks have ended.
2026-08-02T02:12:29.573 Engine:Setting original file name "msdt.exe" for "c:\windows\systemresources\msdt.exe.mun", hr=0x0
2026-08-02T02:12:29.714 Engine:Setting original file name "ScreenMagnifier.exe" for "c:\windows\winsxs\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.20348.5256_none_16b1dbf0cadc5989\magnify.exe.mun", hr=0x0
2026-08-02T02:12:29.995 Engine:Setting original file name "FIREWALLCONTROLPANEL.DLL" for "c:\windows\systemresources\firewallcontrolpanel.dll.mun", hr=0x0
2026-08-02T02:12:30.995 Engine:Setting original file name "Winlangdb.dll" for "c:\windows\winsxs\amd64_microsoft-windows-languagesdb-onecore_31bf3856ad364e35_10.0.20348.3451_none_13b6dc898b15fcbe\winlangdb.dll.mun", hr=0x0
2026-08-02T02:12:31.214 [RTP] Duplicating the current plugin configuration object...
2026-08-02T02:12:31.214 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ...
2026-08-02T02:12:31.214 [RTP] Updating plugin configuration due to recent config changes (0x43e) ...
2026-08-02T02:12:31.214 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-02T02:12:31.214 [RTP] Calling GenerateEngineConfigStruct (0x18) ...
2026-08-02T02:12:31.214 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218
2026-08-02T02:12:32.511 Engine:Setting original file name "d2d1" for "c:\windows\syswow64\d2d1.dll", hr=0x0
2026-08-02T02:12:33.136 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0
2026-08-02T02:12:33.917 Engine:Setting original file name "d2d1" for "c:\windows\system32\d2d1.dll", hr=0x0
2026-08-02T02:12:34.558 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\system32\mpg4decd.dll", hr=0x0
2026-08-02T02:12:34.558 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0
2026-08-02T02:12:35.386 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0
2026-08-02T02:12:36.011 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0
2026-08-02T02:12:36.339 Engine:Setting original file name "msdxm.ocx" for "c:\windows\syswow64\dxmasf.dll", hr=0x0
2026-08-02T02:12:37.027 Engine:Setting original file name "VCOMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcomp140_app.dll", hr=0x0
2026-08-02T02:12:38.573 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\syswow64\acgenral.dll", hr=0x0
2026-08-02T02:12:39.089 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\system32\servicingcommon.dll", hr=0x0
2026-08-02T02:12:39.620 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0
2026-08-02T02:12:39.886 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\system32\licensingwinrt.dll", hr=0x0
2026-08-02T02:12:40.527 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0
2026-08-02T02:12:40.964 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnsvr.exe", hr=0x0
2026-08-02T02:12:42.011 Engine:Setting original file name "ntkrnlmp.exe" for "c:\windows\winsxs\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.20348.5386_none_14ac9716e654f424\ntoskrnl.exe", hr=0x0
2026-08-02T02:12:43.120 Cache Resizing**********Cache stats************
No. Of buckets -> 16000
Each Bucket has max capacity of -> 1 entries
number of Entries is 15283
Number of invalid entries is 0
Number of inserts issued is 488024
Number of replaces issued is 0
Number of insert failures is 2
Number of inserts with duplicate entries is 3010
Number of lookups is 70859009
Number of lookup misses is 2190002
Number of fast lookup misses is 15937585
Number of false fast lookups is 2190000
Number of invalidations is 372487
Number of maintenance invalidations is 83982
Current File Size is 397312
Journal ID = 1d864ae105a6246
Trusted image state = 4 USN = 1171c7
Setup boot count = 2

2026-08-02T02:12:43.402 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0
2026-08-02T02:12:43.417 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnlobby.dll", hr=0x0
2026-08-02T02:12:43.636 [RTP] [RtpConfig] Config change detected, type: 32
2026-08-02T02:12:43.636 [RTP] Duplicating the current plugin configuration object...
2026-08-02T02:12:43.636 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ...
2026-08-02T02:12:43.636 [RTP] Updating plugin configuration due to recent config changes (0x20) ...
2026-08-02T02:12:43.636 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-02T02:12:43.636 [RTP] No config change detected. Not updating plugin configuration.
2026-08-02T02:12:43.636 [RTP] No config changes found. No configuration switch.
2026-08-02T02:12:43.636 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0
2026-08-02T02:12:43.761 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0
2026-08-02T02:12:43.933 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\system32\winresume.exe", hr=0x0
2026-08-02T02:12:44.152 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0
2026-08-02T02:12:44.230 Engine:Setting original file name "setup" for "c:\programdata\package cache\{1de5e707-82da-4db6-b810-5d140cc4cbb3}\vc_redist.x64.exe", hr=0x0
2026-08-02T02:12:44.339 Engine:Setting original file name "mini_installer.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{56eb18f8-b008-4cbd-b6d2-8c97fe7e9062}\150.0.4078.105\microsoftedge_x64_150.0.4078.105_150.0.4078.99.exe", hr=0x0
2026-08-02T02:12:44.714 Engine:Setting original file name "kernel32" for "c:\windows\system32\en-us\kernel32.dll.mui", hr=0x0
2026-08-02T02:12:44.792 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0
2026-08-02T02:12:45.042 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnaddr.dll", hr=0x0
2026-08-02T02:12:45.448 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\wow64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_5e7a191fce5f84c6\rasmigplugin.dll", hr=0x0
2026-08-02T02:12:46.011 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\syswow64\windows.perception.stub.dll", hr=0x0
2026-08-02T02:12:47.730 Engine:Setting original file name "INTL.CPL" for "c:\windows\systemresources\intl.cpl.mun", hr=0x0
2026-08-02T02:12:47.777 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0
2026-08-02T02:12:48.277 Engine:Setting original file name "VsVersion.dll" for "c:\windows\syswow64\msvcr100_clr0400.dll", hr=0x0
2026-08-02T02:12:48.792 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\747e1cba31508bb6bd65bf9a07892fb2\mscorlib.ni.dll", hr=0x0
2026-08-02T02:12:50.183 Engine:Setting original file name "WinSetupUI.exe" for "c:\windows\system32\winsetupui.dll", hr=0x0
2026-08-02T02:12:50.823 Engine:Setting original file name "NOTEPAD.EXE" for "c:\windows\systemresources\notepad.exe.mun", hr=0x0
2026-08-02T02:12:53.089 Engine:Setting original file name "TWINUI.dll" for "c:\windows\systemresources\twinui.dll.mun", hr=0x0
2026-08-02T02:12:54.402 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0
2026-08-02T02:12:54.558 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0
2026-08-02T02:12:54.605 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mpg4decd.dll", hr=0x0
2026-08-02T02:12:55.167 Engine:Setting original file name "WindowsCodecs" for "c:\windows\system32\windowscodecs.dll", hr=0x0
2026-08-02T02:12:55.417 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\syswow64\servicingcommon.dll", hr=0x0
2026-08-02T02:12:55.636 Engine:Setting original file name "audioadg.exe" for "c:\windows\system32\audiodg.exe", hr=0x0
2026-08-02T02:12:55.933 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0
2026-08-02T02:12:56.948 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0
2026-08-02T02:12:57.152 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0
2026-08-02T02:12:57.605 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnathlp.dll", hr=0x0
2026-08-02T02:12:57.714 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0
2026-08-02T02:12:59.152 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0
2026-08-02T02:12:59.620 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\syswow64\windowscodecsraw.dll", hr=0x0
2026-08-02T02:12:59.714 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0
2026-08-02T02:13:00.120 Engine:Setting original file name "NETCENTER.DLL" for "c:\windows\systemresources\netcenter.dll.mun", hr=0x0
2026-08-02T02:13:01.667 Engine:Setting original file name "security.dll" for "c:\windows\syswow64\sspicli.dll", hr=0x0
2026-08-02T02:13:02.167 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\system32\appventsubsystems64.dll", hr=0x0
2026-08-02T02:13:03.214 Engine:Setting original file name "wcp.dll" for "c:\windows\syswow64\ssshim.dll", hr=0x0
2026-08-02T02:13:03.698 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0
2026-08-02T02:13:03.839 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0
2026-08-02T02:13:03.886 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0
2026-08-02T02:13:04.198 Engine:Setting original file name "srchadmin.dll" for "c:\windows\systemresources\srchadmin.dll.mun", hr=0x0
2026-08-02T02:13:04.777 Engine:Setting original file name "VsVersion.dll" for "c:\windows\system32\msvcr100_clr0400.dll", hr=0x0
2026-08-02T02:13:05.027 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mp43decd.dll", hr=0x0
2026-08-02T02:13:05.652 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0
2026-08-02T02:13:06.230 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0
2026-08-02T02:13:06.558 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0
2026-08-02T02:13:07.058 Engine:Setting original file name "SndVolSSO.dll" for "c:\windows\systemresources\sndvolsso.dll.mun", hr=0x0
2026-08-02T02:13:07.152 Engine:Setting original file name "gdi32" for "c:\windows\system32\gdi32.dll", hr=0x0
2026-08-02T02:13:07.198 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnhupnp.dll", hr=0x0
2026-08-02T02:13:07.605 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnaddr.dll", hr=0x0
2026-08-02T02:13:07.933 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\system32\mp4sdecd.dll", hr=0x0
2026-08-02T02:13:09.855 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0
2026-08-02T02:13:09.948 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0
2026-08-02T02:13:10.339 Engine:Setting original file name "extractr.exe" for "c:\windows\system32\wimserv.exe", hr=0x0
2026-08-02T02:13:11.089 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnhpast.dll", hr=0x0
2026-08-02T02:13:11.105 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\system32\migisol.dll", hr=0x0
2026-08-02T02:13:11.308 Engine:Setting original file name "WindowsCodecs" for "c:\windows\syswow64\windowscodecs.dll", hr=0x0
2026-08-02T02:13:12.183 Engine:Setting original file name "powershell.exe" for "c:\windows\system32\windowspowershell\v1.0\powershell.exe", hr=0x0
2026-08-02T02:13:12.448 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\syswow64\ddores.dll", hr=0x0
2026-08-02T02:13:12.745 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0
2026-08-02T02:13:13.308 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnet.dll", hr=0x0
2026-08-02T02:13:13.417 Engine:Setting original file name "filterLib.dll" for "c:\windows\syswow64\fltlib.dll", hr=0x0
2026-08-02T02:13:13.698 Engine:Setting original file name "Microsoft(r) DirectX for Windows(r) - Out Of Band" for "c:\program files (x86)\microsoft\edge\application\150.0.4078.105\dxil.dll", hr=0x0
2026-08-02T02:13:15.823 Engine:Setting original file name "dxmasf.dll" for "c:\windows\system32\msdxm.ocx", hr=0x0
2026-08-02T02:13:15.964 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0
2026-08-02T02:13:16.417 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0
2026-08-02T02:13:18.636 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0
2026-08-02T02:13:18.792 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0
2026-08-02T02:13:18.948 Engine:Setting original file name "mavinject64.exe" for "c:\windows\system32\mavinject.exe", hr=0x0
2026-08-02T02:13:18.948 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0
2026-08-02T02:13:19.980 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0
2026-08-02T02:13:19.995 Engine:Setting original file name "bfsvc.exe" for "c:\windows\system32\ucsvc.exe", hr=0x0
2026-08-02T02:13:20.620 Engine:Setting original file name "aclui.dll" for "c:\windows\winsxs\amd64_microsoft-windows-aclui_31bf3856ad364e35_10.0.20348.3451_none_fd7930e5e5e2f1f1\aclui.dll.mun", hr=0x0
2026-08-02T02:13:20.917 Engine:Setting original file name "dnsapi" for "c:\windows\system32\dnsapi.dll", hr=0x0
2026-08-02T02:13:21.042 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dplaysvr.exe", hr=0x0
2026-08-02T02:13:21.089 Engine:Setting original file name "winsqlite3" for "c:\windows\syswow64\winsqlite3.dll", hr=0x0
2026-08-02T02:13:21.620 Engine:Setting original file name "SHELL32.DLL" for "c:\windows\systemresources\shell32.dll.mun", hr=0x0
2026-08-02T02:13:22.933 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpnet.dll", hr=0x0
2026-08-02T02:13:23.136 Engine:Setting original file name "mapi32.dll" for "c:\windows\system32\mapistub.dll", hr=0x0
2026-08-02T02:13:24.480 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\syswow64\mtf.dll", hr=0x0
2026-08-02T02:13:24.605 Engine:Setting original file name "ACTIONCENTERCPL.DLL" for "c:\windows\systemresources\actioncentercpl.dll.mun", hr=0x0
2026-08-02T02:13:25.120 Engine:Setting original file name "UNPShared.dll" for "c:\windows\system32\upshared.dll", hr=0x0
2026-08-02T02:13:25.183 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnhpast.dll", hr=0x0
2026-08-02T02:13:25.698 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0
2026-08-02T02:13:26.011 Engine:Setting original file name " " for "c:\program files (x86)\microsoft\edge\application\150.0.4078.105\dxcompiler.dll", hr=0x0
2026-08-02T02:13:26.683 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\syswow64\migisol.dll", hr=0x0
2026-08-02T02:13:27.448 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasapi_31bf3856ad364e35_10.0.20348.4767_none_15865bee81d96dc8\pbkmigr.dll", hr=0x0
2026-08-02T02:13:27.558 Engine:Setting original file name "CRYPT32.DLL" for "c:\windows\systemresources\crypt32.dll.mun", hr=0x0
2026-08-02T02:13:27.620 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\system32\windows.perception.stub.dll", hr=0x0
2026-08-02T02:13:28.245 Engine:Setting original file name "mmcndmgr.dll" for "c:\windows\systemresources\mmcndmgr.dll.mun", hr=0x0
2026-08-02T02:13:28.401 Engine:Setting original file name "mapistub.dll" for "c:\windows\syswow64\mapi32.dll", hr=0x0
2026-08-02T02:13:29.745 Engine:Setting original file name "MicrosoftEdgeUpdateSetup.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.251.21\microsoftedgeupdatesetup_x86_1.3.251.21.exe", hr=0x0
2026-08-02T02:13:29.870 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0
2026-08-02T02:13:29.948 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0
2026-08-02T02:13:30.745 Engine:Setting original file name "CRYPTUI.DLL" for "c:\windows\systemresources\cryptui.dll.mun", hr=0x0
2026-08-02T02:13:31.761 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\syswow64\textinputframework.dll", hr=0x0
2026-08-02T02:13:32.745 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0
2026-08-02T02:13:32.917 Engine:Setting original file name "mavinject32.exe" for "c:\windows\syswow64\mavinject.exe", hr=0x0
2026-08-02T02:13:32.980 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0
2026-08-02T02:13:33.136 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0
2026-08-02T02:13:35.808 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0
2026-08-02T02:13:37.276 Engine:Setting original file name "libssl" for "c:\program files\certbot\python\libssl-1_1.dll", hr=0x0
2026-08-02T02:13:38.230 Engine:Setting original file name "spwizres.dll" for "c:\windows\system32\spwizimg.dll", hr=0x0
2026-08-02T02:13:38.542 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpmodemx.dll", hr=0x0
2026-08-02T02:13:39.917 Engine:Setting original file name "mmcbase.dll" for "c:\windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.20348.4163_none_b803623ca7c56bdc\mmcbase.dll.mun", hr=0x0
2026-08-02T02:13:40.011 Engine:Setting original file name "devicecenter.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicecenter_31bf3856ad364e35_10.0.20348.3451_none_50d38896314ab7f0\devicecenter.dll.mun", hr=0x0
2026-08-02T02:13:40.230 Engine:Setting original file name "PlayReady Process EXE" for "c:\windows\system32\prproc.exe", hr=0x0
2026-08-02T02:13:41.355 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0
2026-08-02T02:13:41.542 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0
2026-08-02T02:13:41.980 Engine:Setting original file name "Apphelp" for "c:\windows\syswow64\apphelp.dll", hr=0x0
2026-08-02T02:13:42.401 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0
2026-08-02T02:13:42.605 Engine:Setting original file name "MSPAINT.EXE" for "c:\windows\systemresources\mspaint.exe.mun", hr=0x0
2026-08-02T02:13:42.651 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0
2026-08-02T02:13:42.776 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0
2026-08-02T02:13:44.386 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\system32\mp43decd.dll", hr=0x0
2026-08-02T02:13:45.167 Engine:Setting original file name "gdi32" for "c:\windows\system32\gdi32full.dll", hr=0x0
2026-08-02T02:13:46.730 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dpwsockx.dll", hr=0x0
2026-08-02T02:13:46.823 Engine:Setting original file name "Windows.Security.Credentials.UI.CredentialPicker.exe" for "c:\windows\syswow64\windows.security.credentials.ui.credentialpicker.dll", hr=0x0
2026-08-02T02:13:47.839 Engine:Setting original file name "user32" for "c:\windows\system32\user32.dll", hr=0x0
2026-08-02T02:13:48.308 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.foundation.winmd", hr=0x0
2026-08-02T02:13:48.495 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0
2026-08-02T02:13:48.558 Engine:Setting original file name "Apphelp" for "c:\windows\system32\apphelp.dll", hr=0x0
2026-08-02T02:13:49.651 Engine:Setting original file name "WerMgr" for "c:\windows\winsxs\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.20348.3451_none_c8e584de3820731e\wermgr.exe", hr=0x0
2026-08-02T02:13:49.823 Engine:Setting original file name "osloader.exe" for "c:\windows\system32\winload.exe", hr=0x0
2026-08-02T02:13:51.995 Engine:Setting original file name "mpengine.dll" for "c:\programdata\microsoft\windows defender\definition updates\stableengineetwlocation\mpengine_etw.dll", hr=0x0
2026-08-02T02:13:53.308 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0
2026-08-02T02:13:53.714 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\syswow64\appventsubsystems32.dll", hr=0x0
2026-08-02T02:13:53.745 Engine:Setting original file name "rundll32.exe" for "c:\windows\syswow64\rundll32.exe", hr=0x0
2026-08-02T02:13:54.401 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\syswow64\setup\pbkmigr.dll", hr=0x0
2026-08-02T02:13:54.417 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnathlp.dll", hr=0x0
2026-08-02T02:13:54.448 Engine:Setting original file name "Windows.Security.Credentials.UI.CredentialPicker.exe" for "c:\windows\system32\windows.security.credentials.ui.credentialpicker.dll", hr=0x0
2026-08-02T02:13:54.839 Engine:Setting original file name "libcrypto" for "c:\program files\certbot\python\libcrypto-1_1.dll", hr=0x0
2026-08-02T02:13:55.151 Engine:Setting original file name "notification_helper.exe" for "c:\program files (x86)\microsoft\edge\application\150.0.4078.105\notification_click_helper.exe", hr=0x0
2026-08-02T02:13:56.464 Engine:Setting original file name "reg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.20348.1_none_bb033180f3b60f5e\reg.exe", hr=0x0
2026-08-02T02:13:56.511 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\system32\bcp47langs.dll", hr=0x0
2026-08-02T02:13:58.198 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0
2026-08-02T02:13:58.448 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.251.21\psmachine_64.dll", hr=0x0
2026-08-02T02:13:59.714 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0
2026-08-02T02:14:00.917 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\system32\ucrtbase_enclave.dll", hr=0x0
2026-08-02T02:14:01.370 Engine:Setting original file name "mstsc.exe" for "c:\windows\systemresources\mstsc.exe.mun", hr=0x0
2026-08-02T02:14:03.404 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\syswow64\dplayx.dll", hr=0x0
2026-08-02T02:14:03.683 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32full.dll", hr=0x0
2026-08-02T02:14:04.105 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0
2026-08-02T02:14:05.401 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0
2026-08-02T02:14:05.495 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0
2026-08-02T02:14:06.198 Engine:Setting original file name "mf.dll" for "c:\windows\syswow64\mfpmp.exe", hr=0x0
2026-08-02T02:14:08.573 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0
2026-08-02T02:14:08.636 Engine:Setting original file name "Vulkan Runtime" for "c:\program files (x86)\microsoft\edge\application\150.0.4078.105\vulkan-1.dll", hr=0x0
2026-08-02T02:14:09.839 Engine:Setting original file name "schtasks.exe" for "c:\windows\system32\schtasks.exe", hr=0x0
2026-08-02T02:14:10.808 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0
2026-08-02T02:14:11.667 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0
2026-08-02T02:14:11.667 Engine:Setting original file name "msfltr32.acm" for "c:\windows\syswow64\msacm32.dll", hr=0x0
2026-08-02T02:14:12.151 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0
2026-08-02T02:14:12.167 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0
2026-08-02T02:14:12.386 Engine:Setting original file name "dual_engine_adapter.dll" for "c:\program files (x86)\microsoft\edge\application\150.0.4078.105\dual_engine_adapter_x64.dll", hr=0x0
2026-08-02T02:14:12.417 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0
2026-08-02T02:14:12.433 Engine:Setting original file name "MrmCore.dll" for "c:\windows\syswow64\mrmcorer.dll", hr=0x0
2026-08-02T02:14:13.823 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\system32\applytrustoffline.exe", hr=0x0
2026-08-02T02:14:14.245 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0
2026-08-02T02:14:14.433 Engine:Setting original file name "PowerCPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-powercpl_31bf3856ad364e35_10.0.20348.2849_none_0a22cda3a696a151\powercpl.dll.mun", hr=0x0
2026-08-02T02:14:14.761 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\system32\dpnhupnp.dll", hr=0x0
2026-08-02T02:14:14.886 Engine:Setting original file name "vssadmin.exe" for "c:\windows\system32\vssadmin.exe", hr=0x0
2026-08-02T02:14:14.995 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0
2026-08-02T02:14:15.667 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0
2026-08-02T02:14:16.573 Engine:Setting original file name "stobject.dll" for "c:\windows\systemresources\stobject.dll.mun", hr=0x0
2026-08-02T02:14:16.605 Engine:Setting original file name "schtasks.exe" for "c:\windows\syswow64\schtasks.exe", hr=0x0
2026-08-02T02:14:18.495 OriginalFileName Maintenance::15283 files in Moac, 6 skipped (cached), 191 filename set
2026-08-02T02:14:18.495 [AutoPurge] Routine task for Cache Maintenance has ended.
2026-08-02T02:16:48.573 Bm signature throttled:0x000032b3547485f1
2026-08-02T02:17:07.308 Bm signature throttled:0x000032b3547485f1
2026-08-02T02:21:15.792 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-93ba-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8477747, FileId: 0x90000000c4d92, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:21:15.792 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-93ba-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8477746, FileId: 0x80000000c4da6, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:21:16.011 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-93bb-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8477751, FileId: 0x90000000c4da6, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:21:16.011 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-93bb-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8477752, FileId: 0xa0000000c4d92, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:21:16.542 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-93bc-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8477758, FileId: 0xb0000000c4d92, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:21:16.542 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-93bc-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8477757, FileId: 0xa0000000c4da6, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:21:52.401 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T02:23:06.667 ProcessImageName: httpd.exe, Pid: 4364, TotalTime: 688634, Count: 49651, MaxTime: 515, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\_phpMyAdmin.new\js\vendor\codemirror\lib\codemirror.js, EstimatedImpact: 3%
2026-08-02T02:23:06.667 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 21400, Count: 1131, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: httpd.exe, Pid: 4916, TotalTime: 6548, Count: 354, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\googlemaps\Wienerberg_20050613.html->(SCRIPT0002), EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: explorer.exe, Pid: 3232, TotalTime: 5892, Count: 312, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: explorer.exe, Pid: 5148, TotalTime: 2871, Count: 45, MaxTime: 656, MaxTimeFile: \Device\HarddiskVolume2\nginx\nginx.exe, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: explorer.exe, Pid: 4500, TotalTime: 2064, Count: 145, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$IAGSLW9.php, EstimatedImpact: 75%
2026-08-02T02:23:06.667 ProcessImageName: powershell.exe, Pid: 9088, TotalTime: 1977, Count: 90, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\000a53285985b0def7f9930691f067ae\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 35%
2026-08-02T02:23:06.667 ProcessImageName: AgentShell.exe, Pid: 7480, TotalTime: 1614, Count: 98, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: httpd.exe, Pid: 4344, TotalTime: 1248, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libhttpd.dll, EstimatedImpact: 74%
2026-08-02T02:23:06.667 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 1098, Count: 240, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-26f1-0.MAI, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1036, Count: 56, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: httpd.exe, Pid: 7652, TotalTime: 963, Count: 73, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\sPHDG69Fsq42ArEA9e-xxABuiC5BbJ9i8japwI9iric, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: AgentShellSystemTray.exe, Pid: 2184, TotalTime: 895, Count: 34, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 33%
2026-08-02T02:23:06.667 ProcessImageName: httpd.exe, Pid: 8796, TotalTime: 893, Count: 21, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\PHP53\ext\ioncube_loader_win_5.3.dll, EstimatedImpact: 53%
2026-08-02T02:23:06.667 ProcessImageName: dllhost.exe, Pid: 4576, TotalTime: 744, Count: 54, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: WmiPrvSE.exe, Pid: 7884, TotalTime: 722, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 13%
2026-08-02T02:23:06.667 ProcessImageName: explorer.exe, Pid: 1100, TotalTime: 700, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$I30CG93, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: httpd.exe, Pid: 3452, TotalTime: 635, Count: 13, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php5ts.dll, EstimatedImpact: 96%
2026-08-02T02:23:06.667 ProcessImageName: powershell.exe, Pid: 3424, TotalTime: 634, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\b96f467c2d8ead8ce81b4cdd1f08846e\System.Management.Automation.ni.dll, EstimatedImpact: 20%
2026-08-02T02:23:06.667 ProcessImageName: WmiPrvSE.exe, Pid: 3116, TotalTime: 577, Count: 39, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 42%
2026-08-02T02:23:06.667 ProcessImageName: openssl.exe, Pid: 5900, TotalTime: 562, Count: 3, MaxTime: 406, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libcrypto-3-x64.dll, EstimatedImpact: 100%
2026-08-02T02:23:06.667 ProcessImageName: RuntimeBroker.exe, Pid: 6732, TotalTime: 530, Count: 3, MaxTime: 500, MaxTimeFile: \Device\HarddiskVolume2\Program Files\FileZilla FTP Client\filezilla.exe, EstimatedImpact: 22%
2026-08-02T02:23:06.667 ProcessImageName: httpd.exe, Pid: 7616, TotalTime: 528, Count: 36, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\Rh34zwUdLnkgzypytg777Nd9IcA1vQ6nK6lH7_ze2ag, EstimatedImpact: 9%
2026-08-02T02:23:06.667 ProcessImageName: WmiPrvSE.exe, Pid: 8188, TotalTime: 508, Count: 13, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys, EstimatedImpact: 4%
2026-08-02T02:23:06.667 ProcessImageName: runonce.exe, Pid: 7404, TotalTime: 447, Count: 14, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 30%
2026-08-02T02:23:06.667 ProcessImageName: httpd.exe, Pid: 348, TotalTime: 419, Count: 7, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Apache24\modules\mod_headers.so, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: AgentShellService.exe, Pid: 7152, TotalTime: 354, Count: 25, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Common.Logging.dll, EstimatedImpact: 28%
2026-08-02T02:23:06.667 ProcessImageName: findstr.exe, Pid: 484, TotalTime: 322, Count: 25, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-autoindex.conf, EstimatedImpact: 89%
2026-08-02T02:23:06.667 ProcessImageName: mmc.exe, Pid: 4572, TotalTime: 308, Count: 16, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\c2f05f765d8b9324d606f711fe96f209\MIGUIControls.ni.dll, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: powershell.exe, Pid: 7356, TotalTime: 294, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 34%
2026-08-02T02:23:06.667 ProcessImageName: WmiPrvSE.exe, Pid: 7432, TotalTime: 294, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100%
2026-08-02T02:23:06.667 ProcessImageName: python.exe, Pid: 2956, TotalTime: 289, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\setuptools-69.0.2.dist-info\entry_points.txt, EstimatedImpact: 13%
2026-08-02T02:23:06.667 ProcessImageName: powershell.exe, Pid: 2944, TotalTime: 276, Count: 28, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\cf430d29074ce2bbf03a1250130d46aa\Microsoft.PowerShell.Commands.Utility.ni.dll, EstimatedImpact: 1%
2026-08-02T02:23:06.667 ProcessImageName: mmc.exe, Pid: 9088, TotalTime: 262, Count: 9, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\KZ3GNUWD\views[1], EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 260, Count: 16, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\spool\V4Dirs\2A69E168-833E-4BE0-9D9D-6E354AC311E8\merged.gpd, EstimatedImpact: 4%
2026-08-02T02:23:06.667 ProcessImageName: cmd.exe, Pid: 4580, TotalTime: 218, Count: 2, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\OpenSSL.exe, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: svchost.exe, Pid: 5220, TotalTime: 218, Count: 2, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\DO89A9.tmp, EstimatedImpact: 66%
2026-08-02T02:23:06.667 ProcessImageName: notepad.exe, Pid: 8636, TotalTime: 184, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\httpd.conf, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 183, Count: 9, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: httpd.exe, Pid: 3172, TotalTime: 171, Count: 12, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_noframes.html, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: ngentask.exe, Pid: 5804, TotalTime: 136, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 30%
2026-08-02T02:23:06.667 ProcessImageName: python.exe, Pid: 2920, TotalTime: 122, Count: 7, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\client.py, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: ngentask.exe, Pid: 700, TotalTime: 121, Count: 10, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 22%
2026-08-02T02:23:06.667 ProcessImageName: ngentask.exe, Pid: 4508, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 30%
2026-08-02T02:23:06.667 ProcessImageName: ngentask.exe, Pid: 6752, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-08-02T02:23:06.667 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: python.exe, Pid: 4068, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\accounts\acme-v02.api.letsencrypt.org\directory\612050855f7c1a31bed06818996045ed\regr.json, EstimatedImpact: 28%
2026-08-02T02:23:06.667 ProcessImageName: taskhostw.exe, Pid: 2248, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 16%
2026-08-02T02:23:06.667 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 91, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: notepad.exe, Pid: 8360, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: notepad.exe, Pid: 5768, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-vhosts.conf, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: DeviceCensus.exe, Pid: 1140, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 7%
2026-08-02T02:23:06.667 ProcessImageName: tzsync.exe, Pid: 4380, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezoneMapping.xml->(UTF-8), EstimatedImpact: 45%
2026-08-02T02:23:06.667 ProcessImageName: svchost.exe, Pid: 2972, TotalTime: 61, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator.cdpresource, EstimatedImpact: 1%
2026-08-02T02:23:06.667 ProcessImageName: mysqldump.exe, Pid: 8272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 17%
2026-08-02T02:23:06.667 ProcessImageName: notepad.exe, Pid: 9076, TotalTime: 61, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 7348, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log, EstimatedImpact: 37%
2026-08-02T02:23:06.667 ProcessImageName: python.exe, Pid: 8472, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\mamweb.at.conf, EstimatedImpact: 1%
2026-08-02T02:23:06.667 ProcessImageName: python.exe, Pid: 1792, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\.well-known\acme-challenge\web.config, EstimatedImpact: 2%
2026-08-02T02:23:06.667 ProcessImageName: svchost.exe, Pid: 1360, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\prn0037.tmp, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: powershell.exe, Pid: 5788, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: httpd.exe, Pid: 9132, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Apache24\logs\httpd.pid.iUdTbW, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: cmd.exe, Pid: 3604, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0%
2026-08-02T02:23:06.667 ProcessImageName: powershell.exe, Pid: 8760, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 6%
2026-08-02T02:23:06.667 ProcessImageName: DismHost.exe, Pid: 6036, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{c76cbcad-afc9-11eb-8234-000d3aa6d50e}.TM.blf, EstimatedImpact: 2%
2026-08-02T02:23:06.667 ProcessImageName: python.exe, Pid: 9088, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\web.config, EstimatedImpact: 0%
2026-08-02T02:26:29.042 Bm signature throttled:0x000032b3547485f1
2026-08-02T02:26:33.354 Bm signature throttled:0x000032b3547485f1
2026-08-02T02:26:35.729 Bm signature throttled:0x000032b3547485f1
2026-08-02T02:26:37.604 Bm signature throttled:0x000032b3547485f1
2026-08-02T02:26:40.510 Bm signature throttled:0x000032b3547485f1
2026-08-02T02:26:42.292 Bm signature throttled:0x000032b3547485f1
2026-08-02T02:26:46.698 Bm signature throttled:0x000032b3547485f1
Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e
Internal signature match:subtype=Lowfi, sigseq=0x001107BD8A45AAC6, sigsha=5f443c7a99b8ca69580bdc91a5c96c381a4909ba, cached=false, source=2, resourceid=0xd681195e
2026-08-02T02:35:03.948 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c
Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7
2026-08-02T02:35:03.979 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T02:35:03.979 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T02:35:03.979 [Cloud] Queued cloud request.
2026-08-02T02:35:03.979 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T02:35:03.979 [Cloud] Dequeued cloud request.
2026-08-02T02:35:03.979 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T02:35:04.807 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c
2026-08-02T02:35:04.917 [Cloud] End of cloud request.
2026-08-02T02:35:05.417 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T02:36:57.404 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T02:39:58.291 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-954c-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8487726, FileId: 0x70000000c4dbe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:39:58.291 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-954c-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8487727, FileId: 0x60000000c4dbd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:40:21.744 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T02:40:21.744 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T02:40:21.744 [Cloud] Queued cloud request.
2026-08-02T02:40:21.744 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T02:40:21.744 [Cloud] Dequeued cloud request.
2026-08-02T02:40:21.744 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T02:40:21.916 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1BE02FF3-B1EB-6C10-1308-EA08A20D2291}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 02:40:21
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T02:40:22.416 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T02:48:55.854 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-95b7-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8492287, FileId: 0x90000000c4dd9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:48:55.854 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-95b7-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8492286, FileId: 0x80000000c4dda, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:48:56.776 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-95b8-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8492296, FileId: 0xa0000000c4dd9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:48:56.776 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-95b8-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8492295, FileId: 0x90000000c4dda, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:52:02.401 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T02:52:24.041 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T02:52:24.041 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T02:52:24.041 [Cloud] Queued cloud request.
2026-08-02T02:52:24.041 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T02:52:24.041 [Cloud] Dequeued cloud request.
2026-08-02T02:52:24.041 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T02:52:24.244 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{248EC16D-4D42-D352-726D-73C08D882EEC}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 02:52:24
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T02:52:24.760 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T02:55:02.526 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T02:55:02.526 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T02:55:02.526 [Cloud] Queued cloud request.
2026-08-02T02:55:02.526 [Cloud] Dequeued cloud request.
2026-08-02T02:55:02.526 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T02:55:02.526 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T02:55:02.713 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{597F99CB-E890-DB2D-CF5D-61B4D697921D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 02:55:02
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T02:55:03.229 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T02:55:40.650 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T02:55:40.650 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T02:55:40.650 [Cloud] Queued cloud request.
2026-08-02T02:55:40.650 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T02:55:40.650 [Cloud] Dequeued cloud request.
2026-08-02T02:55:40.650 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T02:55:40.744 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{834AADCA-B4ED-55B3-CD94-95F66D9D7D5C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 02:55:40
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T02:55:41.275 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T02:56:27.572 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-9657-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8495749, FileId: 0x60000000c4de8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T02:56:27.572 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-9657-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8495748, FileId: 0x60000000c4de9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x4652e614
Internal signature match:subtype=Lowfi, sigseq=0x001107BD8A45AAC6, sigsha=5f443c7a99b8ca69580bdc91a5c96c381a4909ba, cached=false, source=2, resourceid=0x4652e614
2026-08-02T02:56:47.525 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpmyserver\help.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x3329faf726b1
2026-08-02T03:00:01.947 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:00:05.541 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:00:13.432 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:00:20.744 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:00:27.713 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:00:34.978 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:00:44.963 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T03:00:44.963 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T03:00:44.963 [Cloud] Queued cloud request.
2026-08-02T03:00:44.963 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T03:00:44.963 [Cloud] Dequeued cloud request.
2026-08-02T03:00:44.963 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T03:00:45.150 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{7202F29C-3A55-9B1C-5C71-D4C534B0BE25}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 03:00:45
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T03:00:45.650 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T03:00:52.822 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:00:54.432 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:00:56.103 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:00:59.572 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:01:01.416 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:01:03.103 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:01:07.525 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:07:07.400 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T03:09:40.275 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T03:09:40.275 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T03:09:40.275 [Cloud] Queued cloud request.
2026-08-02T03:09:40.275 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T03:09:40.463 [Cloud] Dequeued cloud request.
2026-08-02T03:09:40.463 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T03:09:40.619 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{BAA190B8-9068-7A23-4099-C8359343CEA9}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 03:09:40
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T03:09:41.119 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T03:12:22.384 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T03:12:22.384 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T03:12:22.384 [Cloud] Queued cloud request.
2026-08-02T03:12:22.384 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T03:12:22.384 [Cloud] Dequeued cloud request.
2026-08-02T03:12:22.384 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T03:12:22.572 [Cloud] End of cloud request.
2026-08-02T03:12:23.072 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T03:17:03.056 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T03:17:03.056 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T03:17:03.056 [Cloud] Queued cloud request.
2026-08-02T03:17:03.056 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T03:17:03.072 [Cloud] Dequeued cloud request.
2026-08-02T03:17:03.072 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T03:17:03.244 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{67DF5CCA-6B61-4EC7-163C-003D6C15E319}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 03:17:03
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T03:17:03.759 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T03:22:12.400 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T03:24:37.212 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-9896-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8508093, FileId: 0x70000000c4e05, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T03:24:37.212 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-9896-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8508092, FileId: 0x60000000c4e06, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T03:24:44.134 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:24:51.431 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-9897-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8508188, FileId: 0x70000000c4e06, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T03:24:51.431 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-9897-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8508187, FileId: 0x60000000c4e07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T03:24:52.072 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:24:53.525 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:25:01.525 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:25:03.868 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:25:04.697 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:25:05.900 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:25:07.415 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:25:20.853 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:25:23.634 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:32:05.728 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T03:32:05.728 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T03:32:05.728 [Cloud] Queued cloud request.
2026-08-02T03:32:05.728 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T03:32:05.728 [Cloud] Dequeued cloud request.
2026-08-02T03:32:05.728 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T03:32:05.900 [Cloud] End of cloud request.
2026-08-02T03:32:06.415 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T03:32:21.525 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:33:03.025 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:37:10.415 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:37:17.399 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T03:41:05.665 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T03:41:05.665 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T03:41:05.665 [Cloud] Queued cloud request.
2026-08-02T03:41:05.665 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T03:41:05.665 [Cloud] Dequeued cloud request.
2026-08-02T03:41:05.665 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T03:41:05.837 [Cloud] End of cloud request.
2026-08-02T03:41:06.337 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T03:42:58.524 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:43:34.649 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:47:59.493 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:48:30.180 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:49:07.337 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T03:49:07.337 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T03:49:07.337 [Cloud] Queued cloud request.
2026-08-02T03:49:07.337 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T03:49:07.337 [Cloud] Dequeued cloud request.
2026-08-02T03:49:07.337 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T03:49:07.837 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{D41D5BAB-D9BF-FBFB-4957-7A48574DA6E4}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 03:49:07
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T03:49:08.337 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T03:49:33.712 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:50:05.102 Bm signature throttled:0x000032b3547485f1
2026-08-02T03:52:22.399 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T03:55:25.399 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T03:55:25.399 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T03:55:25.399 [Cloud] Queued cloud request.
2026-08-02T03:55:25.399 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T03:55:25.399 [Cloud] Dequeued cloud request.
2026-08-02T03:55:25.399 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T03:55:25.587 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9D0CA9B8-AC6E-C79A-9865-A8CB9B450005}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 03:55:25
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T03:55:26.102 [NRI] Successfully updated NIS service with platform settings for enforcement level Log

BEGIN BM telemetry
GUID:{7705F305-C6AE-A392-EA93-E7B52A517666}
SignatureID:55745797457393
SigSha:ddb4adac2aca8c16554162e265921a50721a9574
ThreatLevel:0
ProcessID:5976
ProcessCreationTime:134301169864660923
SessionID:0
CreationTime:08-02-2026 04:03:06
ImagePath:C:\Windows\SysWOW64\cmd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe:4364:1,
Operations:None
END BM telemetry

2026-08-02T04:03:07.134 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T04:03:07.134 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T04:03:07.134 [Cloud] Queued cloud request.
2026-08-02T04:03:07.134 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T04:03:07.134 [Cloud] Dequeued cloud request.
2026-08-02T04:03:07.134 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T04:03:07.352 [Cloud] End of cloud request.
2026-08-02T04:03:07.867 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T04:03:11.399 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-b19e-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8526019, FileId: 0x180000000c4e8f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T04:03:11.399 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-b19e-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8526020, FileId: 0x180000000c4e88, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T04:03:21.899 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-b1c8-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8526110, FileId: 0x190000000c4e8f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T04:03:21.899 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-b1c8-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8526111, FileId: 0x190000000c4e88, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T04:04:46.071 Bm signature throttled:0x000032b3547485f1
2026-08-02T04:05:15.774 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T04:05:15.774 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T04:05:15.774 [Cloud] Queued cloud request.
2026-08-02T04:05:15.774 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T04:05:15.774 [Cloud] Dequeued cloud request.
2026-08-02T04:05:15.774 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T04:05:15.961 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{BB0DD6D5-2028-3B60-3327-4CACBE3CB7C5}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 04:05:15
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T04:05:16.461 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T04:05:30.821 Bm signature throttled:0x000032b3547485f1
2026-08-02T04:05:42.430 Bm signature throttled:0x000032b3547485f1
2026-08-02T04:06:34.821 Bm signature throttled:0x000032b3547485f1
2026-08-02T04:06:35.899 Bm signature throttled:0x000032b3547485f1
2026-08-02T04:07:27.399 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T04:08:04.523 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-b48c-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8528702, FileId: 0xb0000000c4eaa, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T04:08:04.523 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-b48c-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8528703, FileId: 0xd0000000c4ea7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T04:09:28.070 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-b498-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8529481, FileId: 0xe0000000c4ea7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T04:09:28.070 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-b498-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8529480, FileId: 0xc0000000c4eaa, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T04:12:25.086 [RTP] [Mini-filter] Unsuccessful scan status(#27): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-b524-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8531002, FileId: 0x80000000c4ecd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T04:12:25.086 [RTP] [Mini-filter] Unsuccessful scan status(#28): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-b524-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8531003, FileId: 0x80000000c4ecc, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T04:15:14.180 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T04:15:14.180 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T04:15:14.180 [Cloud] Queued cloud request.
2026-08-02T04:15:14.180 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T04:15:14.180 [Cloud] Dequeued cloud request.
2026-08-02T04:15:14.180 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T04:15:14.351 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{42B3450C-AABE-A52F-BEC3-7472407D3A31}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 04:15:14
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T04:15:14.851 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T04:18:20.554 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T04:18:20.554 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T04:18:20.554 [Cloud] Queued cloud request.
2026-08-02T04:18:20.554 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T04:18:20.554 [Cloud] Dequeued cloud request.
2026-08-02T04:18:20.554 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T04:18:20.711 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{44F6E86D-34E0-9996-983D-BDE2E6B8CC19}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 04:18:20
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T04:18:21.226 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T04:22:32.398 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T04:23:06.679 ProcessImageName: httpd.exe, Pid: 4364, TotalTime: 1135008, Count: 80046, MaxTime: 515, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\_phpMyAdmin.new\js\vendor\codemirror\lib\codemirror.js, EstimatedImpact: 4%
2026-08-02T04:23:06.679 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 21400, Count: 1131, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: httpd.exe, Pid: 4916, TotalTime: 6548, Count: 354, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\googlemaps\Wienerberg_20050613.html->(SCRIPT0002), EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: explorer.exe, Pid: 3232, TotalTime: 5892, Count: 312, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: AgentShell.exe, Pid: 7480, TotalTime: 4239, Count: 298, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: explorer.exe, Pid: 5148, TotalTime: 2871, Count: 45, MaxTime: 656, MaxTimeFile: \Device\HarddiskVolume2\nginx\nginx.exe, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: explorer.exe, Pid: 4500, TotalTime: 2064, Count: 145, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$IAGSLW9.php, EstimatedImpact: 75%
2026-08-02T04:23:06.679 ProcessImageName: powershell.exe, Pid: 9088, TotalTime: 1977, Count: 90, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\000a53285985b0def7f9930691f067ae\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 35%
2026-08-02T04:23:06.679 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 1323, Count: 274, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-26f1-0.MAI, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: httpd.exe, Pid: 4344, TotalTime: 1248, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libhttpd.dll, EstimatedImpact: 74%
2026-08-02T04:23:06.679 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1066, Count: 58, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: httpd.exe, Pid: 7652, TotalTime: 963, Count: 73, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\sPHDG69Fsq42ArEA9e-xxABuiC5BbJ9i8japwI9iric, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: AgentShellSystemTray.exe, Pid: 2184, TotalTime: 895, Count: 34, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 33%
2026-08-02T04:23:06.679 ProcessImageName: httpd.exe, Pid: 8796, TotalTime: 893, Count: 21, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\PHP53\ext\ioncube_loader_win_5.3.dll, EstimatedImpact: 53%
2026-08-02T04:23:06.679 ProcessImageName: dllhost.exe, Pid: 4576, TotalTime: 744, Count: 54, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: WmiPrvSE.exe, Pid: 7884, TotalTime: 722, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 13%
2026-08-02T04:23:06.679 ProcessImageName: explorer.exe, Pid: 1100, TotalTime: 700, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$I30CG93, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: httpd.exe, Pid: 3452, TotalTime: 635, Count: 13, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php5ts.dll, EstimatedImpact: 96%
2026-08-02T04:23:06.679 ProcessImageName: powershell.exe, Pid: 3424, TotalTime: 634, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\b96f467c2d8ead8ce81b4cdd1f08846e\System.Management.Automation.ni.dll, EstimatedImpact: 20%
2026-08-02T04:23:06.679 ProcessImageName: WmiPrvSE.exe, Pid: 3116, TotalTime: 577, Count: 39, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 42%
2026-08-02T04:23:06.679 ProcessImageName: openssl.exe, Pid: 5900, TotalTime: 562, Count: 3, MaxTime: 406, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libcrypto-3-x64.dll, EstimatedImpact: 100%
2026-08-02T04:23:06.679 ProcessImageName: RuntimeBroker.exe, Pid: 6732, TotalTime: 530, Count: 3, MaxTime: 500, MaxTimeFile: \Device\HarddiskVolume2\Program Files\FileZilla FTP Client\filezilla.exe, EstimatedImpact: 22%
2026-08-02T04:23:06.679 ProcessImageName: httpd.exe, Pid: 7616, TotalTime: 528, Count: 36, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\Rh34zwUdLnkgzypytg777Nd9IcA1vQ6nK6lH7_ze2ag, EstimatedImpact: 9%
2026-08-02T04:23:06.679 ProcessImageName: WmiPrvSE.exe, Pid: 8188, TotalTime: 508, Count: 13, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys, EstimatedImpact: 4%
2026-08-02T04:23:06.679 ProcessImageName: runonce.exe, Pid: 7404, TotalTime: 447, Count: 14, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 30%
2026-08-02T04:23:06.679 ProcessImageName: httpd.exe, Pid: 348, TotalTime: 419, Count: 7, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Apache24\modules\mod_headers.so, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: AgentShellService.exe, Pid: 7152, TotalTime: 354, Count: 25, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Common.Logging.dll, EstimatedImpact: 28%
2026-08-02T04:23:06.679 ProcessImageName: findstr.exe, Pid: 484, TotalTime: 322, Count: 25, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-autoindex.conf, EstimatedImpact: 89%
2026-08-02T04:23:06.679 ProcessImageName: mmc.exe, Pid: 4572, TotalTime: 308, Count: 16, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\c2f05f765d8b9324d606f711fe96f209\MIGUIControls.ni.dll, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: powershell.exe, Pid: 7356, TotalTime: 294, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 34%
2026-08-02T04:23:06.679 ProcessImageName: WmiPrvSE.exe, Pid: 7432, TotalTime: 294, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100%
2026-08-02T04:23:06.679 ProcessImageName: python.exe, Pid: 2956, TotalTime: 289, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\setuptools-69.0.2.dist-info\entry_points.txt, EstimatedImpact: 13%
2026-08-02T04:23:06.679 ProcessImageName: powershell.exe, Pid: 2944, TotalTime: 276, Count: 28, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\cf430d29074ce2bbf03a1250130d46aa\Microsoft.PowerShell.Commands.Utility.ni.dll, EstimatedImpact: 1%
2026-08-02T04:23:06.679 ProcessImageName: mmc.exe, Pid: 9088, TotalTime: 262, Count: 9, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\KZ3GNUWD\views[1], EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 260, Count: 16, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\spool\V4Dirs\2A69E168-833E-4BE0-9D9D-6E354AC311E8\merged.gpd, EstimatedImpact: 4%
2026-08-02T04:23:06.679 ProcessImageName: svchost.exe, Pid: 5220, TotalTime: 218, Count: 2, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\DO89A9.tmp, EstimatedImpact: 66%
2026-08-02T04:23:06.679 ProcessImageName: cmd.exe, Pid: 4580, TotalTime: 218, Count: 2, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\OpenSSL.exe, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 213, Count: 11, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 185, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: notepad.exe, Pid: 8636, TotalTime: 184, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\httpd.conf, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: httpd.exe, Pid: 3172, TotalTime: 171, Count: 12, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_noframes.html, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: ngentask.exe, Pid: 5804, TotalTime: 136, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 30%
2026-08-02T04:23:06.679 ProcessImageName: python.exe, Pid: 2920, TotalTime: 122, Count: 7, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\client.py, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: ngentask.exe, Pid: 700, TotalTime: 121, Count: 10, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 22%
2026-08-02T04:23:06.679 ProcessImageName: ngentask.exe, Pid: 6752, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-08-02T04:23:06.679 ProcessImageName: ngentask.exe, Pid: 4508, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 30%
2026-08-02T04:23:06.679 ProcessImageName: python.exe, Pid: 4068, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\accounts\acme-v02.api.letsencrypt.org\directory\612050855f7c1a31bed06818996045ed\regr.json, EstimatedImpact: 28%
2026-08-02T04:23:06.679 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: taskhostw.exe, Pid: 2248, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 16%
2026-08-02T04:23:06.679 ProcessImageName: notepad.exe, Pid: 5768, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-vhosts.conf, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: notepad.exe, Pid: 8360, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: DeviceCensus.exe, Pid: 1140, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 7%
2026-08-02T04:23:06.679 ProcessImageName: tzsync.exe, Pid: 4380, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezoneMapping.xml->(UTF-8), EstimatedImpact: 45%
2026-08-02T04:23:06.679 ProcessImageName: svchost.exe, Pid: 2972, TotalTime: 61, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator.cdpresource, EstimatedImpact: 1%
2026-08-02T04:23:06.679 ProcessImageName: taskhostw.exe, Pid: 9140, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 4%
2026-08-02T04:23:06.679 ProcessImageName: mysqldump.exe, Pid: 8272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 17%
2026-08-02T04:23:06.679 ProcessImageName: notepad.exe, Pid: 9076, TotalTime: 61, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 7348, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log, EstimatedImpact: 37%
2026-08-02T04:23:06.679 ProcessImageName: python.exe, Pid: 1792, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\.well-known\acme-challenge\web.config, EstimatedImpact: 2%
2026-08-02T04:23:06.679 ProcessImageName: svchost.exe, Pid: 1360, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\prn0037.tmp, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: python.exe, Pid: 8472, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\mamweb.at.conf, EstimatedImpact: 1%
2026-08-02T04:23:06.679 ProcessImageName: powershell.exe, Pid: 5788, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: httpd.exe, Pid: 9132, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Apache24\logs\httpd.pid.iUdTbW, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: cmd.exe, Pid: 3604, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-08-02T04:23:06.679 ProcessImageName: powershell.exe, Pid: 8760, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 6%
2026-08-02T04:23:06.679 ProcessImageName: DismHost.exe, Pid: 6036, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{c76cbcad-afc9-11eb-8234-000d3aa6d50e}.TM.blf, EstimatedImpact: 2%
2026-08-02T04:23:06.679 ProcessImageName: python.exe, Pid: 9088, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\web.config, EstimatedImpact: 0%
2026-08-02T04:29:47.398 Bm signature throttled:0x000032b3547485f1
2026-08-02T04:32:46.086 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T04:32:46.086 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T04:32:46.086 [Cloud] Queued cloud request.
2026-08-02T04:32:46.086 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T04:32:46.086 [Cloud] Dequeued cloud request.
2026-08-02T04:32:46.086 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T04:32:46.242 [Cloud] End of cloud request.
2026-08-02T04:32:46.742 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T04:33:40.570 Bm signature throttled:0x000032b3547485f1
2026-08-02T04:33:54.789 Bm signature throttled:0x000032b3547485f1
2026-08-02T04:34:48.101 Bm signature throttled:0x000032b3547485f1
2026-08-02T04:34:50.304 Bm signature throttled:0x000032b3547485f1
2026-08-02T04:37:31.195 [RTP] [Mini-filter] Unsuccessful scan status(#29): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-ce26-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8542615, FileId: 0x500000008b45b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T04:37:31.195 [RTP] [Mini-filter] Unsuccessful scan status(#30): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-ce26-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8542616, FileId: 0x500000008b458, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T04:37:33.335 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T04:37:33.335 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T04:37:33.335 [Cloud] Queued cloud request.
2026-08-02T04:37:33.335 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T04:37:33.335 [Cloud] Dequeued cloud request.
2026-08-02T04:37:33.335 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T04:37:33.491 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4068F7B8-963A-5FFD-B2B7-CBF531F4917F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 04:37:33
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T04:37:33.991 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T04:37:37.398 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T04:39:29.273 [RTP] [Mini-filter] Unsuccessful scan status(#31): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-cea1-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8543438, FileId: 0x600000008b45b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T04:39:29.273 [RTP] [Mini-filter] Unsuccessful scan status(#32): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-cea1-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8543439, FileId: 0x600000008b458, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T04:44:05.101 Bm signature throttled:0x000032b3547485f1
2026-08-02T04:44:19.898 Bm signature throttled:0x000032b3547485f1
2026-08-02T04:48:24.679 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T04:48:24.679 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T04:48:24.679 [Cloud] Queued cloud request.
2026-08-02T04:48:24.679 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T04:48:24.679 [Cloud] Dequeued cloud request.
2026-08-02T04:48:24.679 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T04:48:24.835 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{8B74CE02-E30D-7F44-B887-537768EB9A51}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 04:48:24
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T04:48:25.335 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T04:52:42.397 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T04:56:27.975 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T04:56:27.975 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T04:56:27.975 [Cloud] Queued cloud request.
2026-08-02T04:56:27.975 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T04:56:27.975 [Cloud] Dequeued cloud request.
2026-08-02T04:56:27.975 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T04:56:28.132 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{706FA147-3AD4-C3FB-958A-B0325AB23890}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 04:56:28
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T04:56:28.647 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T05:07:47.397 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)

BEGIN BM telemetry
GUID:{31649B2E-5F4D-B146-D329-793ED77BBB54}
SignatureID:340520518878414
SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0
ThreatLevel:0
ProcessID:4364
ProcessCreationTime:134300926691185095
SessionID:0
CreationTime:08-02-2026 05:15:16
ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T05:15:17.834 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T05:15:17.834 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T05:15:17.834 [Cloud] Queued cloud request.
2026-08-02T05:15:17.834 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T05:15:17.834 [Cloud] Dequeued cloud request.
2026-08-02T05:15:17.834 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T05:15:18.006 [Cloud] End of cloud request.
2026-08-02T05:15:18.522 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T05:19:56.865 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T05:19:56.865 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T05:19:56.865 [Cloud] Queued cloud request.
2026-08-02T05:19:56.865 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T05:19:56.865 [Cloud] Dequeued cloud request.
2026-08-02T05:19:56.865 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T05:19:57.053 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{0ADADF00-765D-AD25-E902-C374D9CF0780}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 05:19:57
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T05:19:57.553 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T05:20:05.615 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T05:20:05.615 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T05:20:05.615 [Cloud] Queued cloud request.
2026-08-02T05:20:05.615 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T05:20:05.615 [Cloud] Dequeued cloud request.
2026-08-02T05:20:05.615 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T05:20:05.897 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{AD840A79-D064-7DB4-30ED-22F62C3CA36B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 05:20:05
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T05:20:06.412 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T05:22:52.397 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T05:23:50.897 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T05:23:50.897 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T05:23:50.897 [Cloud] Queued cloud request.
2026-08-02T05:23:50.897 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T05:23:50.897 [Cloud] Dequeued cloud request.
2026-08-02T05:23:50.897 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T05:23:51.084 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{263E04AB-3937-E5EC-328C-0341E1E047A1}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 05:23:51
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T05:23:51.584 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T05:25:36.959 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T05:25:36.959 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T05:25:36.959 [Cloud] Queued cloud request.
2026-08-02T05:25:36.959 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T05:25:36.959 [Cloud] Dequeued cloud request.
2026-08-02T05:25:36.959 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T05:25:37.178 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9A1B5516-5391-B135-D4D0-6CFF757BD9AC}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 05:25:37
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T05:25:37.678 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T05:37:57.396 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T05:41:00.834 Bm signature throttled:0x000135b39c9104ce
2026-08-02T05:43:34.052 Bm signature throttled:0x000032b3547485f1
2026-08-02T05:44:38.974 Bm signature throttled:0x000032b3547485f1
2026-08-02T05:52:28.818 [RTP] [Mini-filter] Unsuccessful scan status(#33): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e216-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8575602, FileId: 0x50000000c4f37, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T05:52:28.818 [RTP] [Mini-filter] Unsuccessful scan status(#34): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e216-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8575603, FileId: 0x60000000c4f36, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T05:53:02.396 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T05:57:59.411 [RTP] [Mini-filter] Unsuccessful scan status(#36): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e3b7-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8578022, FileId: 0x70000000c4f3f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T05:57:59.411 [RTP] [Mini-filter] Unsuccessful scan status(#35): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e3b7-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8578021, FileId: 0x60000000c4f48, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T05:58:02.802 [RTP] [Mini-filter] Unsuccessful scan status(#37): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e3ba-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8578049, FileId: 0x70000000c4f48, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T05:58:02.802 [RTP] [Mini-filter] Unsuccessful scan status(#38): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e3ba-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8578050, FileId: 0x80000000c4f3f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T05:58:43.458 [RTP] [Mini-filter] Unsuccessful scan status(#39): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e3c0-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8578299, FileId: 0x80000000c4f48, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T05:58:43.458 [RTP] [Mini-filter] Unsuccessful scan status(#40): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e3c0-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8578300, FileId: 0x90000000c4f3f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T05:58:49.927 [RTP] [Mini-filter] Unsuccessful scan status(#41): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e3c3-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8578360, FileId: 0x90000000c4f48, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T05:58:49.927 [RTP] [Mini-filter] Unsuccessful scan status(#42): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e3c3-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8578361, FileId: 0xa0000000c4f3f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T05:58:50.458 [RTP] [Mini-filter] Unsuccessful scan status(#43): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e3c4-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8578372, FileId: 0xa0000000c4f48, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T05:58:50.458 [RTP] [Mini-filter] Unsuccessful scan status(#44): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e3c4-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8578373, FileId: 0xb0000000c4f3f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:03:41.771 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T06:03:41.771 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T06:03:41.771 [Cloud] Queued cloud request.
2026-08-02T06:03:41.771 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T06:03:41.786 [Cloud] Dequeued cloud request.
2026-08-02T06:03:41.786 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T06:03:41.943 [Cloud] End of cloud request.
2026-08-02T06:03:42.458 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T06:08:07.395 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T06:08:08.145 [RTP] [Mini-filter] Unsuccessful scan status(#45): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e4c0-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8581910, FileId: 0x50000000c4f4e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:08:08.145 [RTP] [Mini-filter] Unsuccessful scan status(#46): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e4c0-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8581911, FileId: 0xdb0000000c4f4c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:09:01.302 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T06:09:01.302 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T06:09:01.302 [Cloud] Queued cloud request.
2026-08-02T06:09:01.302 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T06:09:01.302 [Cloud] Dequeued cloud request.
2026-08-02T06:09:01.302 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T06:09:01.927 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{05493185-6087-49FD-6FC1-E78D0D6DF4D1}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 06:09:01
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T06:09:02.427 [NRI] Successfully updated NIS service with platform settings for enforcement level Log

BEGIN BM telemetry
GUID:{09F999EC-885D-E805-A291-FAAC68F99FE5}
SignatureID:55745797457393
SigSha:ddb4adac2aca8c16554162e265921a50721a9574
ThreatLevel:0
ProcessID:6748
ProcessCreationTime:134301247430503257
SessionID:0
CreationTime:08-02-2026 06:12:23
ImagePath:C:\Windows\SysWOW64\cmd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe:4364:3,C:\Windows\System32\csrss.exe:404:2,
Operations:None
END BM telemetry

2026-08-02T06:12:23.833 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T06:12:23.849 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T06:12:23.849 [Cloud] Queued cloud request.
2026-08-02T06:12:23.849 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T06:12:23.849 [Cloud] Dequeued cloud request.
2026-08-02T06:12:23.849 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T06:12:24.239 [Cloud] End of cloud request.
2026-08-02T06:12:24.739 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T06:12:51.567 Bm signature throttled:0x000032b3547485f1
2026-08-02T06:13:46.802 Bm signature throttled:0x000032b3547485f1
2026-08-02T06:13:48.599 [RTP] [Mini-filter] Unsuccessful scan status(#47): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584427, FileId: 0x60000000c4f88, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.599 [RTP] [Mini-filter] Unsuccessful scan status(#48): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584428, FileId: 0x90000000c4f87, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.614 [RTP] [Mini-filter] Unsuccessful scan status(#49): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-3.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584431, FileId: 0x70000000c4f88, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.614 [RTP] [Mini-filter] Unsuccessful scan status(#50): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-3.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584432, FileId: 0xa0000000c4f87, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.614 [RTP] [Mini-filter] Unsuccessful scan status(#51): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-5.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584435, FileId: 0x80000000c4f88, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.614 [RTP] [Mini-filter] Unsuccessful scan status(#52): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-5.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584436, FileId: 0xb0000000c4f87, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.630 [RTP] [Mini-filter] Unsuccessful scan status(#53): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-7.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584439, FileId: 0x90000000c4f88, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.630 [RTP] [Mini-filter] Unsuccessful scan status(#54): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-7.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584440, FileId: 0xc0000000c4f87, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.630 [RTP] [Mini-filter] Unsuccessful scan status(#55): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-9.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584443, FileId: 0xa0000000c4f88, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.630 [RTP] [Mini-filter] Unsuccessful scan status(#56): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-9.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584444, FileId: 0xd0000000c4f87, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.645 [RTP] [Mini-filter] Unsuccessful scan status(#57): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584447, FileId: 0xb0000000c4f88, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.645 [RTP] [Mini-filter] Unsuccessful scan status(#58): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584448, FileId: 0xe0000000c4f87, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.645 [RTP] [Mini-filter] Unsuccessful scan status(#59): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584452, FileId: 0xc0000000c4f88, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.645 [RTP] [Mini-filter] Unsuccessful scan status(#60): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584453, FileId: 0xf0000000c4f87, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.661 [RTP] [Mini-filter] Unsuccessful scan status(#61): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584456, FileId: 0xd0000000c4f88, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.661 [RTP] [Mini-filter] Unsuccessful scan status(#62): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584457, FileId: 0x100000000c4f87, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.677 [RTP] [Mini-filter] Unsuccessful scan status(#63): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-11.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584460, FileId: 0xe0000000c4f88, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:48.677 [RTP] [Mini-filter] Unsuccessful scan status(#64): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e530-11.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8584461, FileId: 0x110000000c4f87, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:13:55.255 Bm signature throttled:0x000032b3547485f1
2026-08-02T06:18:16.614 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T06:18:16.614 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T06:18:16.614 [Cloud] Queued cloud request.
2026-08-02T06:18:16.614 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T06:18:16.614 [Cloud] Dequeued cloud request.
2026-08-02T06:18:16.614 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T06:18:16.817 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{138CCAE2-97A7-C5FB-9AA4-12DDFF6E3DF6}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 06:18:16
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T06:18:17.317 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T06:19:52.880 [RTP] [Mini-filter] Unsuccessful scan status(#65): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e5ba-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8587527, FileId: 0x50000000c4f8a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:19:52.880 [RTP] [Mini-filter] Unsuccessful scan status(#66): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e5ba-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8587528, FileId: 0xf0000000c4f88, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:19:57.473 [RTP] [Mini-filter] Unsuccessful scan status(#68): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e5be-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8587579, FileId: 0x100000000c4f88, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:19:57.473 [RTP] [Mini-filter] Unsuccessful scan status(#67): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e5be-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8587578, FileId: 0x60000000c4f8a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:23:06.676 ProcessImageName: httpd.exe, Pid: 4364, TotalTime: 1337848, Count: 94104, MaxTime: 1546, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 4%
2026-08-02T06:23:06.676 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 21400, Count: 1131, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: AgentShell.exe, Pid: 7480, TotalTime: 7083, Count: 498, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: httpd.exe, Pid: 4916, TotalTime: 6548, Count: 354, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\googlemaps\Wienerberg_20050613.html->(SCRIPT0002), EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: explorer.exe, Pid: 3232, TotalTime: 5892, Count: 312, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: explorer.exe, Pid: 5148, TotalTime: 2871, Count: 45, MaxTime: 656, MaxTimeFile: \Device\HarddiskVolume2\nginx\nginx.exe, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: explorer.exe, Pid: 4500, TotalTime: 2064, Count: 145, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$IAGSLW9.php, EstimatedImpact: 75%
2026-08-02T06:23:06.676 ProcessImageName: powershell.exe, Pid: 9088, TotalTime: 1977, Count: 90, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\000a53285985b0def7f9930691f067ae\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 35%
2026-08-02T06:23:06.676 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 1519, Count: 318, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-26f1-0.MAI, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: httpd.exe, Pid: 4344, TotalTime: 1248, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libhttpd.dll, EstimatedImpact: 74%
2026-08-02T06:23:06.676 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1112, Count: 60, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: httpd.exe, Pid: 7652, TotalTime: 963, Count: 73, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\sPHDG69Fsq42ArEA9e-xxABuiC5BbJ9i8japwI9iric, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: AgentShellSystemTray.exe, Pid: 2184, TotalTime: 895, Count: 34, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 33%
2026-08-02T06:23:06.676 ProcessImageName: httpd.exe, Pid: 8796, TotalTime: 893, Count: 21, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\PHP53\ext\ioncube_loader_win_5.3.dll, EstimatedImpact: 53%
2026-08-02T06:23:06.676 ProcessImageName: dllhost.exe, Pid: 4576, TotalTime: 744, Count: 54, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: WmiPrvSE.exe, Pid: 7884, TotalTime: 722, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 13%
2026-08-02T06:23:06.676 ProcessImageName: explorer.exe, Pid: 1100, TotalTime: 700, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$I30CG93, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: httpd.exe, Pid: 3452, TotalTime: 635, Count: 13, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php5ts.dll, EstimatedImpact: 96%
2026-08-02T06:23:06.676 ProcessImageName: powershell.exe, Pid: 3424, TotalTime: 634, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\b96f467c2d8ead8ce81b4cdd1f08846e\System.Management.Automation.ni.dll, EstimatedImpact: 20%
2026-08-02T06:23:06.676 ProcessImageName: WmiPrvSE.exe, Pid: 3116, TotalTime: 577, Count: 39, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 42%
2026-08-02T06:23:06.676 ProcessImageName: openssl.exe, Pid: 5900, TotalTime: 562, Count: 3, MaxTime: 406, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libcrypto-3-x64.dll, EstimatedImpact: 100%
2026-08-02T06:23:06.676 ProcessImageName: RuntimeBroker.exe, Pid: 6732, TotalTime: 530, Count: 3, MaxTime: 500, MaxTimeFile: \Device\HarddiskVolume2\Program Files\FileZilla FTP Client\filezilla.exe, EstimatedImpact: 22%
2026-08-02T06:23:06.676 ProcessImageName: httpd.exe, Pid: 7616, TotalTime: 528, Count: 36, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\Rh34zwUdLnkgzypytg777Nd9IcA1vQ6nK6lH7_ze2ag, EstimatedImpact: 9%
2026-08-02T06:23:06.676 ProcessImageName: WmiPrvSE.exe, Pid: 8188, TotalTime: 508, Count: 13, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys, EstimatedImpact: 4%
2026-08-02T06:23:06.676 ProcessImageName: runonce.exe, Pid: 7404, TotalTime: 447, Count: 14, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 30%
2026-08-02T06:23:06.676 ProcessImageName: httpd.exe, Pid: 348, TotalTime: 419, Count: 7, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Apache24\modules\mod_headers.so, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: AgentShellService.exe, Pid: 7152, TotalTime: 354, Count: 25, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Common.Logging.dll, EstimatedImpact: 28%
2026-08-02T06:23:06.676 ProcessImageName: findstr.exe, Pid: 484, TotalTime: 322, Count: 25, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-autoindex.conf, EstimatedImpact: 89%
2026-08-02T06:23:06.676 ProcessImageName: mmc.exe, Pid: 4572, TotalTime: 308, Count: 16, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\c2f05f765d8b9324d606f711fe96f209\MIGUIControls.ni.dll, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: powershell.exe, Pid: 7356, TotalTime: 294, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 34%
2026-08-02T06:23:06.676 ProcessImageName: WmiPrvSE.exe, Pid: 7432, TotalTime: 294, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100%
2026-08-02T06:23:06.676 ProcessImageName: python.exe, Pid: 2956, TotalTime: 289, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\setuptools-69.0.2.dist-info\entry_points.txt, EstimatedImpact: 13%
2026-08-02T06:23:06.676 ProcessImageName: powershell.exe, Pid: 2944, TotalTime: 276, Count: 28, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\cf430d29074ce2bbf03a1250130d46aa\Microsoft.PowerShell.Commands.Utility.ni.dll, EstimatedImpact: 1%
2026-08-02T06:23:06.676 ProcessImageName: mmc.exe, Pid: 9088, TotalTime: 262, Count: 9, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\KZ3GNUWD\views[1], EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 260, Count: 16, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\spool\V4Dirs\2A69E168-833E-4BE0-9D9D-6E354AC311E8\merged.gpd, EstimatedImpact: 4%
2026-08-02T06:23:06.676 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 228, Count: 12, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: svchost.exe, Pid: 5220, TotalTime: 218, Count: 2, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\DO89A9.tmp, EstimatedImpact: 66%
2026-08-02T06:23:06.676 ProcessImageName: cmd.exe, Pid: 4580, TotalTime: 218, Count: 2, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\OpenSSL.exe, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 185, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: notepad.exe, Pid: 8636, TotalTime: 184, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\httpd.conf, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: httpd.exe, Pid: 3172, TotalTime: 171, Count: 12, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_noframes.html, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: ngentask.exe, Pid: 5804, TotalTime: 136, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 30%
2026-08-02T06:23:06.676 ProcessImageName: python.exe, Pid: 2920, TotalTime: 122, Count: 7, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\client.py, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: ngentask.exe, Pid: 700, TotalTime: 121, Count: 10, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 22%
2026-08-02T06:23:06.676 ProcessImageName: ngentask.exe, Pid: 6752, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-08-02T06:23:06.676 ProcessImageName: ngentask.exe, Pid: 4508, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 30%
2026-08-02T06:23:06.676 ProcessImageName: python.exe, Pid: 4068, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\accounts\acme-v02.api.letsencrypt.org\directory\612050855f7c1a31bed06818996045ed\regr.json, EstimatedImpact: 28%
2026-08-02T06:23:06.676 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: taskhostw.exe, Pid: 2248, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 16%
2026-08-02T06:23:06.676 ProcessImageName: notepad.exe, Pid: 5768, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-vhosts.conf, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: notepad.exe, Pid: 8360, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: DeviceCensus.exe, Pid: 1140, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 7%
2026-08-02T06:23:06.676 ProcessImageName: tzsync.exe, Pid: 4380, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezoneMapping.xml->(UTF-8), EstimatedImpact: 45%
2026-08-02T06:23:06.676 ProcessImageName: svchost.exe, Pid: 2972, TotalTime: 61, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator.cdpresource, EstimatedImpact: 1%
2026-08-02T06:23:06.676 ProcessImageName: taskhostw.exe, Pid: 9140, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 4%
2026-08-02T06:23:06.676 ProcessImageName: mysqldump.exe, Pid: 8272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 17%
2026-08-02T06:23:06.676 ProcessImageName: notepad.exe, Pid: 9076, TotalTime: 61, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 7348, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log, EstimatedImpact: 37%
2026-08-02T06:23:06.676 ProcessImageName: python.exe, Pid: 1792, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\.well-known\acme-challenge\web.config, EstimatedImpact: 2%
2026-08-02T06:23:06.676 ProcessImageName: svchost.exe, Pid: 1360, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\prn0037.tmp, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: python.exe, Pid: 8472, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\mamweb.at.conf, EstimatedImpact: 1%
2026-08-02T06:23:06.676 ProcessImageName: powershell.exe, Pid: 5788, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: httpd.exe, Pid: 9132, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Apache24\logs\httpd.pid.iUdTbW, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: cmd.exe, Pid: 3604, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-08-02T06:23:06.676 ProcessImageName: powershell.exe, Pid: 8760, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 6%
2026-08-02T06:23:06.676 ProcessImageName: DismHost.exe, Pid: 6036, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{c76cbcad-afc9-11eb-8234-000d3aa6d50e}.TM.blf, EstimatedImpact: 2%
2026-08-02T06:23:06.676 ProcessImageName: python.exe, Pid: 9088, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\web.config, EstimatedImpact: 0%
2026-08-02T06:23:12.395 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T06:23:19.176 [RTP] [Mini-filter] Unsuccessful scan status(#69): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e5d8-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8589027, FileId: 0x600000008b45d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:23:19.176 [RTP] [Mini-filter] Unsuccessful scan status(#70): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e5d8-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8589028, FileId: 0x900000008b43c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:23:20.348 [RTP] [Mini-filter] Unsuccessful scan status(#71): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e5d9-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8589039, FileId: 0x700000008b45d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:23:20.348 [RTP] [Mini-filter] Unsuccessful scan status(#72): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e5d9-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8589040, FileId: 0xa00000008b43c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:23:22.551 [RTP] [Mini-filter] Unsuccessful scan status(#73): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e5da-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8589058, FileId: 0x800000008b45d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:23:22.551 [RTP] [Mini-filter] Unsuccessful scan status(#74): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e5da-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8589059, FileId: 0xb00000008b43c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:28:55.426 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T06:28:55.426 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T06:28:55.426 [Cloud] Queued cloud request.
2026-08-02T06:28:55.426 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T06:28:55.426 [Cloud] Dequeued cloud request.
2026-08-02T06:28:55.426 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T06:28:55.583 [Cloud] End of cloud request.
2026-08-02T06:28:56.098 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T06:29:05.645 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T06:29:05.645 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T06:29:05.645 [Cloud] Queued cloud request.
2026-08-02T06:29:05.645 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T06:29:05.645 [Cloud] Dequeued cloud request.
2026-08-02T06:29:05.645 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T06:29:05.723 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{FEC72DC6-3F37-69D6-5FFB-CF632F4F807A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 06:29:05
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T06:29:06.239 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T06:31:56.332 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T06:31:56.332 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T06:31:56.332 [Cloud] Queued cloud request.
2026-08-02T06:31:56.332 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T06:31:56.332 [Cloud] Dequeued cloud request.
2026-08-02T06:31:56.332 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T06:31:56.489 [Cloud] End of cloud request.
2026-08-02T06:31:57.004 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T06:32:15.895 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T06:32:15.895 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T06:32:15.895 [Cloud] Queued cloud request.
2026-08-02T06:32:15.895 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T06:32:15.895 [Cloud] Dequeued cloud request.
2026-08-02T06:32:15.895 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T06:32:15.973 [Cloud] End of cloud request.
2026-08-02T06:32:16.489 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T06:35:17.082 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T06:35:17.082 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T06:35:17.082 [Cloud] Queued cloud request.
2026-08-02T06:35:17.082 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T06:35:17.082 [Cloud] Dequeued cloud request.
2026-08-02T06:35:17.082 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T06:35:17.223 [Cloud] End of cloud request.
2026-08-02T06:35:17.739 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T06:37:18.098 [RTP] [Mini-filter] Unsuccessful scan status(#75): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e6cd-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8594255, FileId: 0x50000000c4f8f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:37:18.098 [RTP] [Mini-filter] Unsuccessful scan status(#76): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e6cd-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8594256, FileId: 0x80000000c4f8e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:37:45.364 [RTP] [Mini-filter] Unsuccessful scan status(#77): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e6e2-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8594455, FileId: 0x60000000c4f8f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:37:45.364 [RTP] [Mini-filter] Unsuccessful scan status(#78): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-e6e2-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8594456, FileId: 0x90000000c4f8e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:38:17.395 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T06:46:56.738 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T06:46:56.738 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T06:46:56.738 [Cloud] Queued cloud request.
2026-08-02T06:46:56.738 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T06:46:56.738 [Cloud] Dequeued cloud request.
2026-08-02T06:46:56.738 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T06:46:57.895 [Cloud] End of cloud request.
2026-08-02T06:46:58.410 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T06:47:29.723 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T06:47:29.723 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T06:47:29.723 [Cloud] Queued cloud request.
2026-08-02T06:47:29.723 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T06:47:29.723 [Cloud] Dequeued cloud request.
2026-08-02T06:47:29.723 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T06:47:29.832 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{7E7CAE58-6BEF-135A-7898-39FBFABE9151}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 06:47:29
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T06:47:30.332 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T06:50:18.566 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T06:50:18.566 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T06:50:18.566 [Cloud] Queued cloud request.
2026-08-02T06:50:18.566 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T06:50:18.723 [Cloud] Dequeued cloud request.
2026-08-02T06:50:18.723 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T06:50:18.895 [Cloud] End of cloud request.
2026-08-02T06:50:19.410 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T06:53:22.394 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T06:57:41.457 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T06:57:41.457 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T06:57:41.457 [Cloud] Queued cloud request.
2026-08-02T06:57:41.457 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T06:57:41.457 [Cloud] Dequeued cloud request.
2026-08-02T06:57:41.457 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T06:57:41.629 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{4BFB6535-A964-E19B-DAC1-90DA8FD2D00E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 06:57:41
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T06:57:42.144 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T06:58:23.676 [RTP] [Mini-filter] Unsuccessful scan status(#79): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-eeaf-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8601961, FileId: 0x40000000c5149, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:58:23.676 [RTP] [Mini-filter] Unsuccessful scan status(#80): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-eeaf-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8601962, FileId: 0x40000000c5148, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:59:36.785 [RTP] [Mini-filter] Unsuccessful scan status(#81): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-ef00-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8602400, FileId: 0x30000000c514b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T06:59:36.785 [RTP] [Mini-filter] Unsuccessful scan status(#82): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-ef00-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8602401, FileId: 0x40000000c514a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:01:03.785 Bm signature throttled:0x000135b39c9104ce
2026-08-02T07:01:27.894 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T07:01:27.894 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T07:01:27.894 [Cloud] Queued cloud request.
2026-08-02T07:01:27.894 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T07:01:27.894 [Cloud] Dequeued cloud request.
2026-08-02T07:01:27.894 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T07:01:28.082 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{23F8059C-E78C-81D9-D64D-CF0BDA7C9FBB}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 07:01:28
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T07:01:28.597 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T07:08:16.628 Bm signature throttled:0x000032b3547485f1
2026-08-02T07:08:27.394 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T07:08:44.253 Bm signature throttled:0x000032b3547485f1
2026-08-02T07:11:19.238 Bm signature throttled:0x000032b3547485f1
2026-08-02T07:13:20.113 [RTP] [Mini-filter] Unsuccessful scan status(#83): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607484, FileId: 0x40000000c5180, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.113 [RTP] [Mini-filter] Unsuccessful scan status(#84): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607485, FileId: 0x50000000c517f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.128 [RTP] [Mini-filter] Unsuccessful scan status(#85): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-3.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607488, FileId: 0x50000000c5180, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.128 [RTP] [Mini-filter] Unsuccessful scan status(#86): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-3.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607489, FileId: 0x60000000c517f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.144 [RTP] [Mini-filter] Unsuccessful scan status(#87): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-5.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607492, FileId: 0x60000000c5180, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.144 [RTP] [Mini-filter] Unsuccessful scan status(#88): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-5.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607493, FileId: 0x70000000c517f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.160 [RTP] [Mini-filter] Unsuccessful scan status(#89): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-7.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607496, FileId: 0x70000000c5180, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.160 [RTP] [Mini-filter] Unsuccessful scan status(#90): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-7.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607497, FileId: 0x80000000c517f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.175 [RTP] [Mini-filter] Unsuccessful scan status(#93): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-9.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607501, FileId: 0x90000000c517f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.175 [RTP] [Mini-filter] Unsuccessful scan status(#91): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-9.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607500, FileId: 0x80000000c5180, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.175 [RTP] [Mini-filter] Unsuccessful scan status(#92): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607504, FileId: 0x90000000c5180, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.191 [RTP] [Mini-filter] Unsuccessful scan status(#94): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607505, FileId: 0xa0000000c517f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.191 [RTP] [Mini-filter] Unsuccessful scan status(#95): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607508, FileId: 0xa0000000c5180, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.191 [RTP] [Mini-filter] Unsuccessful scan status(#96): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607509, FileId: 0xb0000000c517f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.207 [RTP] [Mini-filter] Unsuccessful scan status(#98): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607513, FileId: 0xc0000000c517f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.207 [RTP] [Mini-filter] Unsuccessful scan status(#97): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607512, FileId: 0xb0000000c5180, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.222 [RTP] [Mini-filter] Unsuccessful scan status(#99): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-11.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607516, FileId: 0xc0000000c5180, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:20.222 [RTP] [Mini-filter] Unsuccessful scan status(#100): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-fadd-11.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8607517, FileId: 0xd0000000c517f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:13:24.425 Bm signature throttled:0x000032b3547485f1
2026-08-02T07:23:32.394 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T07:25:00.410 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T07:25:00.410 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T07:25:00.410 [Cloud] Queued cloud request.
2026-08-02T07:25:00.410 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T07:25:00.410 [Cloud] Dequeued cloud request.
2026-08-02T07:25:00.410 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T07:25:00.613 [Cloud] End of cloud request.
2026-08-02T07:25:01.113 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T07:28:14.597 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T07:28:14.597 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T07:28:14.597 [Cloud] Queued cloud request.
2026-08-02T07:28:14.597 [Cloud] Dequeued cloud request.
2026-08-02T07:28:14.597 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T07:28:14.613 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T07:28:14.769 [Cloud] End of cloud request.
2026-08-02T07:28:15.269 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T07:30:01.456 Bm signature throttled:0x000032b3547485f1
2026-08-02T07:31:36.831 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T07:31:36.831 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T07:31:36.847 [Cloud] Queued cloud request.
2026-08-02T07:31:36.847 [Cloud] Dequeued cloud request.
2026-08-02T07:31:36.847 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T07:31:37.003 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T07:31:37.409 [Cloud] End of cloud request.
2026-08-02T07:31:37.925 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T07:32:16.284 Bm signature throttled:0x000032b3547485f1
2026-08-02T07:32:28.362 Bm signature throttled:0x000032b3547485f1
2026-08-02T07:33:49.409 Bm signature throttled:0x000032b3547485f1
2026-08-02T07:33:50.253 Bm signature throttled:0x000032b3547485f1
2026-08-02T07:33:51.534 Bm signature throttled:0x000032b3547485f1
2026-08-02T07:34:20.456 Bm signature throttled:0x000032b3547485f1
2026-08-02T07:37:38.737 [RTP] [Mini-filter] Unsuccessful scan status(#110): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-13fdf-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8617622, FileId: 0x2a000000026817, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:38:37.394 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T07:38:58.534 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T07:38:58.534 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T07:38:58.534 [Cloud] Queued cloud request.
2026-08-02T07:38:58.534 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T07:38:58.534 [Cloud] Dequeued cloud request.
2026-08-02T07:38:58.534 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T07:38:58.737 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{5F416A0B-05FE-6645-5655-FB0EB37614CF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 07:38:58
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T07:38:59.253 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T07:44:47.659 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T07:44:47.659 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T07:44:47.659 [Cloud] Queued cloud request.
2026-08-02T07:44:47.659 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T07:44:47.659 [Cloud] Dequeued cloud request.
2026-08-02T07:44:47.659 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T07:44:47.878 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E50FDE33-BE7A-5B64-6AAF-022943794AF8}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 07:44:47
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T07:44:48.378 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T07:46:47.206 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T07:46:47.206 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T07:46:47.206 [Cloud] Queued cloud request.
2026-08-02T07:46:47.206 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T07:46:47.206 [Cloud] Dequeued cloud request.
2026-08-02T07:46:47.206 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T07:46:47.393 [Cloud] End of cloud request.
2026-08-02T07:46:47.893 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T07:46:58.441 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T07:46:58.441 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T07:46:58.441 [Cloud] Queued cloud request.
2026-08-02T07:46:58.441 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T07:46:58.441 [Cloud] Dequeued cloud request.
2026-08-02T07:46:58.441 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T07:46:58.518 [Cloud] End of cloud request.
2026-08-02T07:46:59.034 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T07:49:37.565 Bm signature throttled:0x000032b3547485f1
2026-08-02T07:51:10.034 Bm signature throttled:0x000032b3547485f1
2026-08-02T07:51:12.050 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T07:51:12.050 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T07:51:12.065 [Cloud] Queued cloud request.
2026-08-02T07:51:12.065 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T07:51:12.065 [Cloud] Dequeued cloud request.
2026-08-02T07:51:12.065 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T07:51:12.284 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{3D4C01AE-59DA-5E44-FFA1-AFAED2C17E1B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 07:51:12
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T07:51:12.784 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T07:53:42.393 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T07:56:07.831 [RTP] [Mini-filter] Unsuccessful scan status(#120): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-15617-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8624531, FileId: 0x1b000000037ad4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T07:57:27.206 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T07:57:27.206 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T07:57:27.206 [Cloud] Queued cloud request.
2026-08-02T07:57:27.206 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T07:57:27.206 [Cloud] Dequeued cloud request.
2026-08-02T07:57:27.206 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T07:57:27.425 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{496C0E84-E836-29FB-BE96-DB93D02DBAD4}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 07:57:27
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T07:57:27.940 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:00:47.612 [RTP] [Mini-filter] Unsuccessful scan status(#130): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-15627-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8626330, FileId: 0x1d000000037ad4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T08:03:13.003 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:03:13.003 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:03:13.003 [Cloud] Queued cloud request.
2026-08-02T08:03:13.003 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:03:13.003 [Cloud] Dequeued cloud request.
2026-08-02T08:03:13.003 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:03:13.159 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{0FFA58E8-1A82-7355-4098-3BC680DC5C5E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 08:03:13
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:03:13.659 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:07:13.346 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:07:13.346 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:07:13.346 [Cloud] Queued cloud request.
2026-08-02T08:07:13.346 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:07:13.346 [Cloud] Dequeued cloud request.
2026-08-02T08:07:13.346 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:07:13.502 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{7B9FCF06-879F-69DB-43A4-E050F2A58F94}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 08:07:13
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:07:14.003 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:08:47.393 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T08:09:36.534 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:09:36.534 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:09:36.534 [Cloud] Queued cloud request.
2026-08-02T08:09:36.534 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:09:36.534 [Cloud] Dequeued cloud request.
2026-08-02T08:09:36.534 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:09:36.674 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{0D4C882A-4207-E8F9-9E1A-51C5EB22669A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 08:09:36
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:09:37.190 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:16:13.424 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:16:13.424 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:16:13.424 [Cloud] Queued cloud request.
2026-08-02T08:16:13.424 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:16:13.424 [Cloud] Dequeued cloud request.
2026-08-02T08:16:13.424 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{5C23DE9E-4F8D-8E3C-BB1E-63A02A7493D5}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 08:16:13
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:16:13.643 [Cloud] End of cloud request.
2026-08-02T08:16:14.143 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:16:25.862 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:16:25.862 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:16:25.862 [Cloud] Queued cloud request.
2026-08-02T08:16:25.862 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:16:25.877 [Cloud] Dequeued cloud request.
2026-08-02T08:16:25.877 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:16:25.955 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{90E4A227-40A9-9398-401B-AC80F47D052A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 08:16:25
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:16:26.455 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:16:28.377 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:16:28.377 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:16:28.377 [Cloud] Queued cloud request.
2026-08-02T08:16:28.377 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:16:28.377 [Cloud] Dequeued cloud request.
2026-08-02T08:16:28.377 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:16:28.455 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{48D4F61B-0399-1217-CF3B-D9F081D627A5}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 08:16:28
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:16:28.971 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:23:06.690 ProcessImageName: httpd.exe, Pid: 4364, TotalTime: 1473635, Count: 102262, MaxTime: 1546, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 3%
2026-08-02T08:23:06.690 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 21400, Count: 1131, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: AgentShell.exe, Pid: 7480, TotalTime: 10199, Count: 698, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: httpd.exe, Pid: 4916, TotalTime: 6548, Count: 354, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\googlemaps\Wienerberg_20050613.html->(SCRIPT0002), EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: explorer.exe, Pid: 3232, TotalTime: 5892, Count: 312, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: explorer.exe, Pid: 5148, TotalTime: 2871, Count: 45, MaxTime: 656, MaxTimeFile: \Device\HarddiskVolume2\nginx\nginx.exe, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: explorer.exe, Pid: 4500, TotalTime: 2064, Count: 145, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$IAGSLW9.php, EstimatedImpact: 75%
2026-08-02T08:23:06.690 ProcessImageName: powershell.exe, Pid: 9088, TotalTime: 1977, Count: 90, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\000a53285985b0def7f9930691f067ae\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 35%
2026-08-02T08:23:06.690 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 1895, Count: 388, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-26f1-0.MAI, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: httpd.exe, Pid: 4344, TotalTime: 1248, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libhttpd.dll, EstimatedImpact: 74%
2026-08-02T08:23:06.690 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1112, Count: 60, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: httpd.exe, Pid: 7652, TotalTime: 963, Count: 73, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\sPHDG69Fsq42ArEA9e-xxABuiC5BbJ9i8japwI9iric, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: AgentShellSystemTray.exe, Pid: 2184, TotalTime: 895, Count: 34, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 33%
2026-08-02T08:23:06.690 ProcessImageName: httpd.exe, Pid: 8796, TotalTime: 893, Count: 21, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\PHP53\ext\ioncube_loader_win_5.3.dll, EstimatedImpact: 53%
2026-08-02T08:23:06.690 ProcessImageName: dllhost.exe, Pid: 4576, TotalTime: 744, Count: 54, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: WmiPrvSE.exe, Pid: 7884, TotalTime: 722, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 13%
2026-08-02T08:23:06.690 ProcessImageName: explorer.exe, Pid: 1100, TotalTime: 700, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$I30CG93, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: httpd.exe, Pid: 3452, TotalTime: 635, Count: 13, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php5ts.dll, EstimatedImpact: 96%
2026-08-02T08:23:06.690 ProcessImageName: powershell.exe, Pid: 3424, TotalTime: 634, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\b96f467c2d8ead8ce81b4cdd1f08846e\System.Management.Automation.ni.dll, EstimatedImpact: 20%
2026-08-02T08:23:06.690 ProcessImageName: WmiPrvSE.exe, Pid: 3116, TotalTime: 577, Count: 39, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 42%
2026-08-02T08:23:06.690 ProcessImageName: openssl.exe, Pid: 5900, TotalTime: 562, Count: 3, MaxTime: 406, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libcrypto-3-x64.dll, EstimatedImpact: 100%
2026-08-02T08:23:06.690 ProcessImageName: RuntimeBroker.exe, Pid: 6732, TotalTime: 530, Count: 3, MaxTime: 500, MaxTimeFile: \Device\HarddiskVolume2\Program Files\FileZilla FTP Client\filezilla.exe, EstimatedImpact: 22%
2026-08-02T08:23:06.690 ProcessImageName: httpd.exe, Pid: 7616, TotalTime: 528, Count: 36, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\Rh34zwUdLnkgzypytg777Nd9IcA1vQ6nK6lH7_ze2ag, EstimatedImpact: 9%
2026-08-02T08:23:06.690 ProcessImageName: WmiPrvSE.exe, Pid: 8188, TotalTime: 508, Count: 13, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys, EstimatedImpact: 4%
2026-08-02T08:23:06.690 ProcessImageName: runonce.exe, Pid: 7404, TotalTime: 447, Count: 14, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 30%
2026-08-02T08:23:06.690 ProcessImageName: httpd.exe, Pid: 348, TotalTime: 419, Count: 7, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Apache24\modules\mod_headers.so, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: AgentShellService.exe, Pid: 7152, TotalTime: 354, Count: 25, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Common.Logging.dll, EstimatedImpact: 28%
2026-08-02T08:23:06.690 ProcessImageName: findstr.exe, Pid: 484, TotalTime: 322, Count: 25, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-autoindex.conf, EstimatedImpact: 89%
2026-08-02T08:23:06.690 ProcessImageName: mmc.exe, Pid: 4572, TotalTime: 308, Count: 16, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\c2f05f765d8b9324d606f711fe96f209\MIGUIControls.ni.dll, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: powershell.exe, Pid: 7356, TotalTime: 294, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 34%
2026-08-02T08:23:06.690 ProcessImageName: WmiPrvSE.exe, Pid: 7432, TotalTime: 294, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100%
2026-08-02T08:23:06.690 ProcessImageName: python.exe, Pid: 2956, TotalTime: 289, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\setuptools-69.0.2.dist-info\entry_points.txt, EstimatedImpact: 13%
2026-08-02T08:23:06.690 ProcessImageName: powershell.exe, Pid: 2944, TotalTime: 276, Count: 28, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\cf430d29074ce2bbf03a1250130d46aa\Microsoft.PowerShell.Commands.Utility.ni.dll, EstimatedImpact: 1%
2026-08-02T08:23:06.690 ProcessImageName: mmc.exe, Pid: 9088, TotalTime: 262, Count: 9, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\KZ3GNUWD\views[1], EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 260, Count: 16, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\spool\V4Dirs\2A69E168-833E-4BE0-9D9D-6E354AC311E8\merged.gpd, EstimatedImpact: 4%
2026-08-02T08:23:06.690 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 228, Count: 13, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: svchost.exe, Pid: 5220, TotalTime: 218, Count: 2, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\DO89A9.tmp, EstimatedImpact: 66%
2026-08-02T08:23:06.690 ProcessImageName: cmd.exe, Pid: 4580, TotalTime: 218, Count: 2, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\OpenSSL.exe, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 185, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: notepad.exe, Pid: 8636, TotalTime: 184, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\httpd.conf, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: httpd.exe, Pid: 3172, TotalTime: 171, Count: 12, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_noframes.html, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: ngentask.exe, Pid: 5804, TotalTime: 136, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 30%
2026-08-02T08:23:06.690 ProcessImageName: python.exe, Pid: 2920, TotalTime: 122, Count: 7, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\client.py, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: ngentask.exe, Pid: 700, TotalTime: 121, Count: 10, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 22%
2026-08-02T08:23:06.690 ProcessImageName: ngentask.exe, Pid: 6752, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-08-02T08:23:06.690 ProcessImageName: ngentask.exe, Pid: 4508, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 30%
2026-08-02T08:23:06.690 ProcessImageName: python.exe, Pid: 4068, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\accounts\acme-v02.api.letsencrypt.org\directory\612050855f7c1a31bed06818996045ed\regr.json, EstimatedImpact: 28%
2026-08-02T08:23:06.690 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: taskhostw.exe, Pid: 2248, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 16%
2026-08-02T08:23:06.690 ProcessImageName: notepad.exe, Pid: 5768, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-vhosts.conf, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: notepad.exe, Pid: 8360, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: DeviceCensus.exe, Pid: 1140, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 7%
2026-08-02T08:23:06.690 ProcessImageName: tzsync.exe, Pid: 4380, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezoneMapping.xml->(UTF-8), EstimatedImpact: 45%
2026-08-02T08:23:06.690 ProcessImageName: svchost.exe, Pid: 2972, TotalTime: 61, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator.cdpresource, EstimatedImpact: 1%
2026-08-02T08:23:06.690 ProcessImageName: taskhostw.exe, Pid: 9140, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 4%
2026-08-02T08:23:06.690 ProcessImageName: mysqldump.exe, Pid: 8272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 17%
2026-08-02T08:23:06.690 ProcessImageName: notepad.exe, Pid: 9076, TotalTime: 61, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 7348, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log, EstimatedImpact: 37%
2026-08-02T08:23:06.690 ProcessImageName: python.exe, Pid: 1792, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\.well-known\acme-challenge\web.config, EstimatedImpact: 2%
2026-08-02T08:23:06.690 ProcessImageName: svchost.exe, Pid: 1360, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\prn0037.tmp, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: python.exe, Pid: 8472, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\mamweb.at.conf, EstimatedImpact: 1%
2026-08-02T08:23:06.690 ProcessImageName: powershell.exe, Pid: 5788, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: httpd.exe, Pid: 9132, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Apache24\logs\httpd.pid.iUdTbW, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: cmd.exe, Pid: 3604, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-08-02T08:23:06.690 ProcessImageName: powershell.exe, Pid: 8760, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 6%
2026-08-02T08:23:06.690 ProcessImageName: DismHost.exe, Pid: 6036, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{c76cbcad-afc9-11eb-8234-000d3aa6d50e}.TM.blf, EstimatedImpact: 2%
2026-08-02T08:23:06.690 ProcessImageName: python.exe, Pid: 9088, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\web.config, EstimatedImpact: 0%
2026-08-02T08:23:19.159 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:23:19.159 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:23:19.159 [Cloud] Queued cloud request.
2026-08-02T08:23:19.159 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:23:19.159 [Cloud] Dequeued cloud request.
2026-08-02T08:23:19.159 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:23:19.346 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{822DEE00-D41D-7024-163D-AAD8F522FDCA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 08:23:19
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:23:19.862 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:23:52.393 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)

BEGIN BM telemetry
GUID:{9B0AAB27-E4D7-387D-5734-CF4292695B16}
SignatureID:340520518878414
SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0
ThreatLevel:0
ProcessID:4364
ProcessCreationTime:134300926691185095
SessionID:0
CreationTime:08-02-2026 08:24:46
ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:24:47.471 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:24:47.471 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:24:47.471 [Cloud] Queued cloud request.
2026-08-02T08:24:47.471 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:24:47.471 [Cloud] Dequeued cloud request.
2026-08-02T08:24:47.471 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:24:47.643 [Cloud] End of cloud request.
2026-08-02T08:24:48.158 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf44ca826
2026-08-02T08:26:46.611 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:26:46.611 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:26:46.611 [Cloud] Queued cloud request.
2026-08-02T08:26:46.611 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:26:46.611 [Cloud] Dequeued cloud request.
2026-08-02T08:26:46.611 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:26:46.877 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\eeccbfa1842a7dbe801b892ae41eaea4854d37e0
Dynamic Signature Compilation Timestamp:08-02-2026 08:26:46
Persistence Type:Duration
Time remaining:50065408
2026-08-02T08:26:46.877 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T08:26:46.877 [Cloud] End of cloud request.
2026-08-02T08:26:47.393 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x9b5a6cb4
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x05fc8670
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x6e0cfa0b
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x98f36706
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x253cc3a8
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x71dce5a3
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xc6d16b7c
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf3434529
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xe7a3b2dc
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x261ba995
2026-08-02T08:29:24.940 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:29:24.940 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:29:24.940 [Cloud] Queued cloud request.
2026-08-02T08:29:24.940 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:29:24.940 [Cloud] Dequeued cloud request.
2026-08-02T08:29:24.940 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:29:25.221 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\f451ed2198bdf915ba8343e27937bdc788464861
Dynamic Signature Compilation Timestamp:08-02-2026 08:29:25
Persistence Type:Duration
Time remaining:50065408
2026-08-02T08:29:25.221 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T08:29:25.221 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x33fd2761
2026-08-02T08:29:25.486 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:29:25.486 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:29:25.486 [Cloud] Queued cloud request.
2026-08-02T08:29:25.486 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:29:25.486 [Cloud] Dequeued cloud request.
2026-08-02T08:29:25.486 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:29:25.627 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\627163acd22a72a09f5968af8cfd06722cdba5c8
Dynamic Signature Compilation Timestamp:08-02-2026 08:29:25
Persistence Type:Duration
Time remaining:50065408
2026-08-02T08:29:25.627 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T08:29:25.627 [Cloud] End of cloud request.
2026-08-02T08:29:25.736 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x5dd28877
2026-08-02T08:30:20.080 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:30:20.080 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:30:20.080 [Cloud] Queued cloud request.
2026-08-02T08:30:20.080 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:30:20.080 [Cloud] Dequeued cloud request.
2026-08-02T08:30:20.080 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:30:20.158 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{D58BC166-7B65-496D-4521-0EC7AF9338FE}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 08:30:20
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:30:20.674 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:30:21.768 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:30:21.768 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:30:21.768 [Cloud] Queued cloud request.
2026-08-02T08:30:21.768 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:30:21.768 [Cloud] Dequeued cloud request.
2026-08-02T08:30:21.768 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:30:21.846 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{BD21C5C3-F899-18E7-D2E1-B6CEDD738016}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 08:30:21
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:30:22.346 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd633b41e
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xfcab50b1
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf0a23934
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x355f327c
2026-08-02T08:36:34.785 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:36:34.785 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:36:34.785 [Cloud] Queued cloud request.
2026-08-02T08:36:34.785 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:36:34.785 [Cloud] Dequeued cloud request.
2026-08-02T08:36:34.785 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\e801fc70c3042c789b870de64c4ea5a7db2d0ab7
Dynamic Signature Compilation Timestamp:08-02-2026 08:36:35
Persistence Type:Duration
Time remaining:50065408
2026-08-02T08:36:35.221 Dynamic signature received
2026-08-02T08:36:35.221 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T08:36:35.221 [Cloud] End of cloud request.
2026-08-02T08:36:35.721 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xb6a7f7ef
2026-08-02T08:37:11.189 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:37:11.189 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:37:11.189 [Cloud] Queued cloud request.
2026-08-02T08:37:11.189 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:37:11.189 [Cloud] Dequeued cloud request.
2026-08-02T08:37:11.189 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:37:11.299 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{83B28E3F-9020-1741-C1AB-BD10061E3949}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 08:37:11
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:37:11.814 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:38:57.392 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T08:39:13.736 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:39:13.736 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:39:13.736 [Cloud] Queued cloud request.
2026-08-02T08:39:13.736 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:39:13.736 [Cloud] Dequeued cloud request.
2026-08-02T08:39:13.752 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:39:13.924 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F8A506DA-D062-72E1-8F64-7CF8C76F86D7}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 08:39:13
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:39:14.439 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x7b8a9a09
2026-08-02T08:40:42.721 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:40:42.721 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:40:42.721 [Cloud] Queued cloud request.
2026-08-02T08:40:42.721 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:40:42.721 [Cloud] Dequeued cloud request.
2026-08-02T08:40:42.721 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:40:42.924 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\59be4e4408fd54bf443f2ad9d93907137232be48
Dynamic Signature Compilation Timestamp:08-02-2026 08:40:42
Persistence Type:Duration
Time remaining:50065408
2026-08-02T08:40:42.924 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T08:40:42.924 [Cloud] End of cloud request.
2026-08-02T08:40:43.424 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd7fe9ccd
2026-08-02T08:41:06.877 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:41:06.877 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:41:06.877 [Cloud] Queued cloud request.
2026-08-02T08:41:06.877 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:41:06.877 [Cloud] Dequeued cloud request.
2026-08-02T08:41:06.877 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:41:07.268 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\9aca463ac6865e76218ea738e7ef48f5fa888e38
Dynamic Signature Compilation Timestamp:08-02-2026 08:41:07
Persistence Type:Duration
Time remaining:150196224
2026-08-02T08:41:07.268 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T08:41:07.268 [Cloud] End of cloud request.
2026-08-02T08:41:07.768 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd967ad92
2026-08-02T08:41:08.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:41:08.643 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:41:08.643 [Cloud] Queued cloud request.
2026-08-02T08:41:08.643 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:41:08.643 [Cloud] Dequeued cloud request.
2026-08-02T08:41:08.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:41:08.736 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\d84122efe8ab1aed861f18e44c3ae54e543287d0
Dynamic Signature Compilation Timestamp:08-02-2026 08:41:08
Persistence Type:Duration
Time remaining:50065408
2026-08-02T08:41:08.736 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T08:41:08.736 [Cloud] End of cloud request.
2026-08-02T08:41:09.252 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:42:18.924 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:42:18.924 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:42:18.924 [Cloud] Queued cloud request.
2026-08-02T08:42:18.924 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:42:18.924 [Cloud] Dequeued cloud request.
2026-08-02T08:42:18.924 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:42:19.080 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2E9AB8A4-0DDF-F2DC-B94A-4F0A8336B0A5}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 08:42:19
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:42:19.580 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x1d3ef8e9
2026-08-02T08:42:49.096 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:42:49.096 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:42:49.096 [Cloud] Queued cloud request.
2026-08-02T08:42:49.096 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:42:49.096 [Cloud] Dequeued cloud request.
2026-08-02T08:42:49.096 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:42:49.330 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\bcc64a2bdd1ed65a5906a40bae9ca701b831bdf0
Dynamic Signature Compilation Timestamp:08-02-2026 08:42:49
Persistence Type:Duration
Time remaining:50065408
2026-08-02T08:42:49.346 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T08:42:49.346 [Cloud] End of cloud request.
2026-08-02T08:42:49.861 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x3a511a20
2026-08-02T08:42:50.721 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:42:50.721 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:42:50.721 [Cloud] Queued cloud request.
2026-08-02T08:42:50.721 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:42:50.721 [Cloud] Dequeued cloud request.
2026-08-02T08:42:50.721 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:42:50.877 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\4441ce4c6cc0290cdc93eb59d18c56e584dbb70f
Dynamic Signature Compilation Timestamp:08-02-2026 08:42:50
Persistence Type:Duration
Time remaining:50065408
2026-08-02T08:42:50.877 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T08:42:50.877 [Cloud] End of cloud request.
2026-08-02T08:42:51.393 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:46:56.330 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:46:56.330 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:46:56.330 [Cloud] Queued cloud request.
2026-08-02T08:46:56.330 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:46:56.330 [Cloud] Dequeued cloud request.
2026-08-02T08:46:56.346 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:46:56.502 [Cloud] End of cloud request.
2026-08-02T08:46:57.002 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:52:00.330 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:52:00.330 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:52:00.346 [Cloud] Queued cloud request.
2026-08-02T08:52:00.346 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:52:00.346 [Cloud] Dequeued cloud request.
2026-08-02T08:52:00.346 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{051A8FD4-F9C4-5FDB-D1E2-A3EF52FDAC98}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 08:52:00
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:52:00.517 [Cloud] End of cloud request.
2026-08-02T08:52:01.033 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:53:27.096 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:53:27.096 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:53:27.096 [Cloud] Queued cloud request.
2026-08-02T08:53:27.096 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:53:27.096 [Cloud] Dequeued cloud request.
2026-08-02T08:53:27.096 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:53:27.267 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{C10F227F-11FD-AFEE-F5CD-65C9C08E7BA0}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 08:53:27
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T08:53:27.767 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T08:54:02.455 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)

BEGIN BM telemetry
GUID:{05C3D81F-780B-09FF-C44F-E32ED2F0E580}
SignatureID:55745797457393
SigSha:ddb4adac2aca8c16554162e265921a50721a9574
ThreatLevel:0
ProcessID:2976
ProcessCreationTime:134301345542388681
SessionID:0
CreationTime:08-02-2026 08:55:55
ImagePath:C:\Windows\SysWOW64\cmd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe:4364:3,C:\Windows\System32\csrss.exe:404:2,
Operations:None
END BM telemetry

2026-08-02T08:55:56.580 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:55:56.580 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:55:56.580 [Cloud] Queued cloud request.
2026-08-02T08:55:56.580 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:55:56.580 [Cloud] Dequeued cloud request.
2026-08-02T08:55:56.603 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:55:57.111 [Cloud] End of cloud request.
2026-08-02T08:55:57.611 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x00001727EB7DE8C7, sigsha=115083f33e9b3434e10dc3900db3aa2bba53de1c, cached=false, source=2, resourceid=0xa0a85b0f
2026-08-02T08:58:38.955 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T08:58:38.955 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T08:58:38.955 [Cloud] Queued cloud request.
2026-08-02T08:58:38.955 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T08:58:38.955 [Cloud] Dequeued cloud request.
2026-08-02T08:58:38.955 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T08:58:39.158 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\bc4a9d4466a715d5141d2e4f4caf7ef118e51bd3
Dynamic Signature Compilation Timestamp:08-02-2026 08:58:39
Persistence Type:Duration
Time remaining:150196224
2026-08-02T08:58:39.158 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T08:58:39.158 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x00000070DE3CA1F0, sigsha=da39a3ee5e6b4b0d3255bfef95601890afd80709, cached=false, source=2, resourceid=0xa0a85b0f
2026-08-02T08:58:39.205 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\prnjobs.vbs. status=0x40030000, statusex=0x200, threatid=0x80000000, sigseq=0x1727eb7de8c7
2026-08-02T08:58:39.658 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T09:00:49.908 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T09:00:49.908 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T09:00:49.908 [Cloud] Queued cloud request.
2026-08-02T09:00:49.908 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T09:00:49.908 [Cloud] Dequeued cloud request.
2026-08-02T09:00:49.908 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{057E42C3-D329-8515-1F9C-411E2E36901E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 09:00:50
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T09:00:50.064 [Cloud] End of cloud request.
2026-08-02T09:00:50.595 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T09:00:51.611 Bm signature throttled:0x000032b3547485f1
2026-08-02T09:05:10.548 Bm signature throttled:0x000032b3547485f1
2026-08-02T09:06:54.767 Cache Resizing**********Cache stats************
No. Of buckets -> 20000
Each Bucket has max capacity of -> 1 entries
number of Entries is 19197
Number of invalid entries is 0
Number of inserts issued is 509775
Number of replaces issued is 0
Number of insert failures is 3
Number of inserts with duplicate entries is 3010
Number of lookups is 70926624
Number of lookup misses is 2197833
Number of fast lookup misses is 15971072
Number of false fast lookups is 2197831
Number of invalidations is 372489
Number of maintenance invalidations is 83982
Current File Size is 495616
Journal ID = 1d864ae105a6246
Trusted image state = 4 USN = 1171c7
Setup boot count = 2

2026-08-02T09:06:55.283 [RTP] [RtpConfig] Config change detected, type: 32
2026-08-02T09:06:55.283 [RTP] Duplicating the current plugin configuration object...
2026-08-02T09:06:55.283 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ...
2026-08-02T09:06:55.283 [RTP] Updating plugin configuration due to recent config changes (0x20) ...
2026-08-02T09:06:55.283 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-02T09:06:55.283 [RTP] No config change detected. Not updating plugin configuration.
2026-08-02T09:06:55.283 [RTP] No config changes found. No configuration switch.
2026-08-02T09:06:55.283 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0
2026-08-02T09:06:56.439 Bm signature throttled:0x000032b3547485f1
Internal signature match:subtype=Lowfi, sigseq=0x000084E7E01AFFB6, sigsha=7a815adb9b9e14267419c8f39edc71f49b2651f9, cached=false, source=2, resourceid=0xefb492cd
Internal signature match:subtype=Lowfi, sigseq=0x0000B1E79AAAACC6, sigsha=36046c13f19c561aedb654f634ba085d6a607ced, cached=false, source=2, resourceid=0xefb492cd
2026-08-02T09:09:07.455 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x29c4f31e
2026-08-02T09:13:35.720 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T09:13:35.720 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T09:13:35.720 [Cloud] Queued cloud request.
2026-08-02T09:13:35.720 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T09:13:35.720 [Cloud] Dequeued cloud request.
2026-08-02T09:13:35.720 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\71e415b7f46f84dda8d10f67a1c56ae1ccf63832
Dynamic Signature Compilation Timestamp:08-02-2026 09:13:35
Persistence Type:Duration
Time remaining:50065408
2026-08-02T09:13:35.986 Dynamic signature received
2026-08-02T09:13:35.986 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T09:13:36.017 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x99f5818f
2026-08-02T09:13:36.392 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T09:13:36.392 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T09:13:36.392 [Cloud] Queued cloud request.
2026-08-02T09:13:36.392 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T09:13:36.392 [Cloud] Dequeued cloud request.
2026-08-02T09:13:36.392 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T09:13:36.517 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\974d0c8b1c1f3eaad1030cd48e645de0af31fdcf
Dynamic Signature Compilation Timestamp:08-02-2026 09:13:36
Persistence Type:Duration
Time remaining:50065408
2026-08-02T09:13:36.548 Dynamic signature received
2026-08-02T09:13:36.548 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T09:13:36.548 [Cloud] End of cloud request.
2026-08-02T09:13:37.064 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x1e9b05b3
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x0693a32f
2026-08-02T09:13:41.611 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T09:13:41.611 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T09:13:41.611 [Cloud] Queued cloud request.
2026-08-02T09:13:41.611 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T09:13:41.611 [Cloud] Dequeued cloud request.
2026-08-02T09:13:41.611 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T09:13:41.986 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\2677d53351101ee77359498103a39cc5c5dc37cb
Dynamic Signature Compilation Timestamp:08-02-2026 09:13:41
Persistence Type:Duration
Time remaining:50065408
2026-08-02T09:13:41.986 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T09:13:41.986 [Cloud] End of cloud request.
2026-08-02T09:13:42.486 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x0afff0ba
2026-08-02T09:13:42.877 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T09:13:42.877 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T09:13:42.877 [Cloud] Queued cloud request.
2026-08-02T09:13:42.877 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T09:13:42.877 [Cloud] Dequeued cloud request.
2026-08-02T09:13:42.877 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T09:13:43.173 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\b4bff35f3962b7dab1e41372a77a485529bdb2ed
Dynamic Signature Compilation Timestamp:08-02-2026 09:13:43
Persistence Type:Duration
Time remaining:150196224
2026-08-02T09:13:43.173 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T09:13:43.173 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf3c38fd2
2026-08-02T09:13:43.501 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T09:13:43.501 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T09:13:43.501 [Cloud] Queued cloud request.
2026-08-02T09:13:43.501 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T09:13:43.501 [Cloud] Dequeued cloud request.
2026-08-02T09:13:43.501 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T09:13:43.673 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T09:13:43.892 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\e957d72b9b3c1a026e940ea9e394e99c6705e3be
Dynamic Signature Compilation Timestamp:08-02-2026 09:13:43
Persistence Type:Duration
Time remaining:150196224
2026-08-02T09:13:43.892 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T09:13:43.892 [Cloud] End of cloud request.
2026-08-02T09:13:44.408 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x01d18069
2026-08-02T09:13:44.751 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T09:13:44.751 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T09:13:44.751 [Cloud] Queued cloud request.
2026-08-02T09:13:44.751 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T09:13:44.751 [Cloud] Dequeued cloud request.
2026-08-02T09:13:44.751 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\97b964afa70471f94755968d7d624c780b922e6d
Dynamic Signature Compilation Timestamp:08-02-2026 09:13:44
Persistence Type:Duration
Time remaining:50065408
2026-08-02T09:13:44.908 Dynamic signature received
2026-08-02T09:13:44.908 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T09:13:44.908 [Cloud] End of cloud request.
2026-08-02T09:13:45.423 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T09:14:26.033 Bm signature throttled:0x000032b3547485f1
2026-08-02T09:14:27.736 Bm signature throttled:0x000032b3547485f1
2026-08-02T09:15:58.267 Bm signature throttled:0x000032b3547485f1
2026-08-02T09:16:02.548 Bm signature throttled:0x000032b3547485f1
2026-08-02T09:16:04.970 Bm signature throttled:0x000032b3547485f1
2026-08-02T09:16:07.314 Bm signature throttled:0x000032b3547485f1
2026-08-02T09:16:10.408 Bm signature throttled:0x000032b3547485f1
2026-08-02T09:16:13.955 Bm signature throttled:0x000032b3547485f1
2026-08-02T09:16:51.392 Bm signature throttled:0x000032b3547485f1
2026-08-02T09:17:34.751 Bm signature throttled:0x000032b3547485f1
2026-08-02T09:17:46.892 Bm signature throttled:0x000032b3547485f1
2026-08-02T09:21:18.001 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T09:21:18.001 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T09:21:18.001 [Cloud] Queued cloud request.
2026-08-02T09:21:18.001 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T09:21:18.001 [Cloud] Dequeued cloud request.
2026-08-02T09:21:18.001 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T09:21:18.173 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1BA532DF-D026-635E-EE4C-A37205F324F7}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 09:21:18
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T09:21:18.673 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T09:24:12.392 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T09:25:34.032 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T09:25:34.032 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T09:25:34.032 [Cloud] Queued cloud request.
2026-08-02T09:25:34.032 [Cloud] Dequeued cloud request.
2026-08-02T09:25:34.048 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T09:25:34.048 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T09:25:34.189 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E1255011-D59B-8917-3876-81ABC76F3B93}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 09:25:34
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T09:25:34.704 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T09:32:40.454 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T09:32:40.454 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T09:32:40.454 [Cloud] Queued cloud request.
2026-08-02T09:32:40.454 [Cloud] Dequeued cloud request.
2026-08-02T09:32:40.454 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T09:32:40.454 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T09:32:40.610 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{699226E1-E0D4-2DB8-E398-26D69E7C826F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 09:32:40
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T09:32:41.110 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T09:36:52.454 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T09:36:52.454 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T09:36:52.454 [Cloud] Queued cloud request.
2026-08-02T09:36:52.454 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T09:36:52.454 [Cloud] Dequeued cloud request.
2026-08-02T09:36:52.454 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T09:36:52.626 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{EA3CD5F4-59D3-755A-DF19-05B72352682A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 09:36:52
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T09:36:53.126 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T09:37:31.392 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T09:37:31.392 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T09:37:31.392 [Cloud] Queued cloud request.
2026-08-02T09:37:31.392 [Cloud] Dequeued cloud request.
2026-08-02T09:37:31.392 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T09:37:31.392 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T09:37:31.485 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{B0BA8DB4-03CC-D8A3-BF51-4C88CA13D1BE}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 09:37:31
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T09:37:32.001 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T09:39:17.392 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x80e1edee
2026-08-02T09:48:00.985 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T09:48:00.985 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T09:48:00.985 [Cloud] Queued cloud request.
2026-08-02T09:48:00.985 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T09:48:00.985 [Cloud] Dequeued cloud request.
2026-08-02T09:48:00.985 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T09:48:01.173 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{AAD4989C-4BDD-6E91-1E02-33A1EF2A8904}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 09:48:01
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T09:48:01.688 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T09:54:22.391 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T09:54:52.985 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T09:54:52.985 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T09:54:52.985 [Cloud] Queued cloud request.
2026-08-02T09:54:52.985 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T09:54:52.985 [Cloud] Dequeued cloud request.
2026-08-02T09:54:52.985 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T09:54:53.173 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1399691C-6927-640D-195F-4735DEE2981B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 09:54:53
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T09:54:53.673 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf082d4c3
2026-08-02T10:06:26.313 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:06:26.313 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:06:26.313 [Cloud] Queued cloud request.
2026-08-02T10:06:26.313 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:06:26.313 [Cloud] Dequeued cloud request.
2026-08-02T10:06:26.313 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:06:26.485 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{05E59E70-31D8-3C28-044D-B470921EB4AD}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 10:06:26
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T10:06:27.000 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T10:08:24.750 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:08:24.750 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:08:24.750 [Cloud] Queued cloud request.
2026-08-02T10:08:24.750 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:08:24.750 [Cloud] Dequeued cloud request.
2026-08-02T10:08:24.750 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{108F2349-DD98-2CB7-23FA-40EF121094F2}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 10:08:24
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T10:08:24.907 [Cloud] End of cloud request.
2026-08-02T10:08:25.407 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T10:08:40.547 Bm signature throttled:0x000032b3547485f1
2026-08-02T10:08:46.938 Bm signature throttled:0x000032b3547485f1
2026-08-02T10:09:27.391 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T10:09:51.407 Bm signature throttled:0x000032b3547485f1
2026-08-02T10:09:52.610 Bm signature throttled:0x000032b3547485f1
2026-08-02T10:09:53.704 Bm signature throttled:0x000032b3547485f1
2026-08-02T10:11:03.141 Bm signature throttled:0x000032b3547485f1
2026-08-02T10:12:49.297 Bm signature throttled:0x000032b3547485f1
2026-08-02T10:12:51.078 Bm signature throttled:0x000032b3547485f1
2026-08-02T10:15:30.110 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:15:30.110 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:15:30.110 [Cloud] Queued cloud request.
2026-08-02T10:15:30.110 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:15:30.110 [Cloud] Dequeued cloud request.
2026-08-02T10:15:30.110 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{B50330F7-A41A-993C-97A0-CD48D2E965F4}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 10:15:30
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T10:15:30.250 [Cloud] End of cloud request.
2026-08-02T10:15:30.750 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T10:19:28.906 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:19:28.906 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:19:28.906 [Cloud] Queued cloud request.
2026-08-02T10:19:28.906 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:19:28.906 [Cloud] Dequeued cloud request.
2026-08-02T10:19:28.906 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:19:29.078 [Cloud] End of cloud request.
2026-08-02T10:19:29.578 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x9fa1fa16
2026-08-02T10:19:52.797 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:19:52.797 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:19:52.797 [Cloud] Queued cloud request.
2026-08-02T10:19:52.797 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:19:52.797 [Cloud] Dequeued cloud request.
2026-08-02T10:19:52.797 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:19:52.906 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\b8827e6e14bf05ef786ad4b00fdb3816c5575f45
Dynamic Signature Compilation Timestamp:08-02-2026 10:19:52
Persistence Type:Duration
Time remaining:50065408
2026-08-02T10:19:52.922 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T10:19:52.922 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x902f696f
2026-08-02T10:19:53.281 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:19:53.281 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:19:53.281 [Cloud] Queued cloud request.
2026-08-02T10:19:53.281 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:19:53.281 [Cloud] Dequeued cloud request.
2026-08-02T10:19:53.281 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:19:53.422 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T10:19:53.453 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\a20f0ee7721b472739353f408b232689e1accc1a
Dynamic Signature Compilation Timestamp:08-02-2026 10:19:53
Persistence Type:Duration
Time remaining:50065408
2026-08-02T10:19:53.453 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T10:19:53.453 [Cloud] End of cloud request.
2026-08-02T10:19:53.969 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x8474861b
2026-08-02T10:20:18.828 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:20:18.828 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:20:18.828 [Cloud] Queued cloud request.
2026-08-02T10:20:18.828 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:20:18.828 [Cloud] Dequeued cloud request.
2026-08-02T10:20:18.828 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\6a438a1cd1882f6e0e7d46a4ddc71bb340771365
Dynamic Signature Compilation Timestamp:08-02-2026 10:20:18
Persistence Type:Duration
Time remaining:50065408
2026-08-02T10:20:18.969 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T10:20:18.969 [Cloud] End of cloud request.
2026-08-02T10:20:18.969 Dynamic signature received
2026-08-02T10:20:19.469 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T10:23:06.703 ProcessImageName: httpd.exe, Pid: 4364, TotalTime: 1787274, Count: 120221, MaxTime: 1546, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 3%
2026-08-02T10:23:06.703 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 21400, Count: 1131, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: AgentShell.exe, Pid: 7480, TotalTime: 13287, Count: 898, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: httpd.exe, Pid: 4916, TotalTime: 6548, Count: 354, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\googlemaps\Wienerberg_20050613.html->(SCRIPT0002), EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: explorer.exe, Pid: 3232, TotalTime: 5892, Count: 312, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: explorer.exe, Pid: 5148, TotalTime: 2871, Count: 45, MaxTime: 656, MaxTimeFile: \Device\HarddiskVolume2\nginx\nginx.exe, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: explorer.exe, Pid: 4500, TotalTime: 2064, Count: 145, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$IAGSLW9.php, EstimatedImpact: 75%
2026-08-02T10:23:06.703 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 2016, Count: 398, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-26f1-0.MAI, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: powershell.exe, Pid: 9088, TotalTime: 1977, Count: 90, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\000a53285985b0def7f9930691f067ae\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 35%
2026-08-02T10:23:06.703 ProcessImageName: httpd.exe, Pid: 4344, TotalTime: 1248, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libhttpd.dll, EstimatedImpact: 74%
2026-08-02T10:23:06.703 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1234, Count: 68, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: httpd.exe, Pid: 7652, TotalTime: 963, Count: 73, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\sPHDG69Fsq42ArEA9e-xxABuiC5BbJ9i8japwI9iric, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: AgentShellSystemTray.exe, Pid: 2184, TotalTime: 895, Count: 34, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 33%
2026-08-02T10:23:06.703 ProcessImageName: httpd.exe, Pid: 8796, TotalTime: 893, Count: 21, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\PHP53\ext\ioncube_loader_win_5.3.dll, EstimatedImpact: 53%
2026-08-02T10:23:06.703 ProcessImageName: dllhost.exe, Pid: 4576, TotalTime: 744, Count: 54, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: WmiPrvSE.exe, Pid: 7884, TotalTime: 722, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 13%
2026-08-02T10:23:06.703 ProcessImageName: explorer.exe, Pid: 1100, TotalTime: 700, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$I30CG93, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: httpd.exe, Pid: 3452, TotalTime: 635, Count: 13, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php5ts.dll, EstimatedImpact: 96%
2026-08-02T10:23:06.703 ProcessImageName: powershell.exe, Pid: 3424, TotalTime: 634, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\b96f467c2d8ead8ce81b4cdd1f08846e\System.Management.Automation.ni.dll, EstimatedImpact: 20%
2026-08-02T10:23:06.703 ProcessImageName: WmiPrvSE.exe, Pid: 3116, TotalTime: 577, Count: 39, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 42%
2026-08-02T10:23:06.703 ProcessImageName: openssl.exe, Pid: 5900, TotalTime: 562, Count: 3, MaxTime: 406, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libcrypto-3-x64.dll, EstimatedImpact: 100%
2026-08-02T10:23:06.703 ProcessImageName: RuntimeBroker.exe, Pid: 6732, TotalTime: 530, Count: 3, MaxTime: 500, MaxTimeFile: \Device\HarddiskVolume2\Program Files\FileZilla FTP Client\filezilla.exe, EstimatedImpact: 22%
2026-08-02T10:23:06.703 ProcessImageName: httpd.exe, Pid: 7616, TotalTime: 528, Count: 36, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\Rh34zwUdLnkgzypytg777Nd9IcA1vQ6nK6lH7_ze2ag, EstimatedImpact: 9%
2026-08-02T10:23:06.703 ProcessImageName: WmiPrvSE.exe, Pid: 8188, TotalTime: 508, Count: 13, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys, EstimatedImpact: 4%
2026-08-02T10:23:06.703 ProcessImageName: runonce.exe, Pid: 7404, TotalTime: 447, Count: 14, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 30%
2026-08-02T10:23:06.703 ProcessImageName: httpd.exe, Pid: 348, TotalTime: 419, Count: 7, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Apache24\modules\mod_headers.so, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: AgentShellService.exe, Pid: 7152, TotalTime: 354, Count: 25, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Common.Logging.dll, EstimatedImpact: 28%
2026-08-02T10:23:06.703 ProcessImageName: findstr.exe, Pid: 484, TotalTime: 322, Count: 25, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-autoindex.conf, EstimatedImpact: 89%
2026-08-02T10:23:06.703 ProcessImageName: mmc.exe, Pid: 4572, TotalTime: 308, Count: 16, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\c2f05f765d8b9324d606f711fe96f209\MIGUIControls.ni.dll, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: powershell.exe, Pid: 7356, TotalTime: 294, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 34%
2026-08-02T10:23:06.703 ProcessImageName: WmiPrvSE.exe, Pid: 7432, TotalTime: 294, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100%
2026-08-02T10:23:06.703 ProcessImageName: python.exe, Pid: 2956, TotalTime: 289, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\setuptools-69.0.2.dist-info\entry_points.txt, EstimatedImpact: 13%
2026-08-02T10:23:06.703 ProcessImageName: powershell.exe, Pid: 2944, TotalTime: 276, Count: 28, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\cf430d29074ce2bbf03a1250130d46aa\Microsoft.PowerShell.Commands.Utility.ni.dll, EstimatedImpact: 1%
2026-08-02T10:23:06.703 ProcessImageName: mmc.exe, Pid: 9088, TotalTime: 262, Count: 9, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\KZ3GNUWD\views[1], EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 260, Count: 16, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\spool\V4Dirs\2A69E168-833E-4BE0-9D9D-6E354AC311E8\merged.gpd, EstimatedImpact: 4%
2026-08-02T10:23:06.703 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 243, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: svchost.exe, Pid: 5220, TotalTime: 218, Count: 2, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\DO89A9.tmp, EstimatedImpact: 66%
2026-08-02T10:23:06.703 ProcessImageName: cmd.exe, Pid: 4580, TotalTime: 218, Count: 2, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\OpenSSL.exe, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 185, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: notepad.exe, Pid: 8636, TotalTime: 184, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\httpd.conf, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: httpd.exe, Pid: 3172, TotalTime: 171, Count: 12, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_noframes.html, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: ngentask.exe, Pid: 5804, TotalTime: 136, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 30%
2026-08-02T10:23:06.703 ProcessImageName: python.exe, Pid: 2920, TotalTime: 122, Count: 7, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\client.py, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: ngentask.exe, Pid: 700, TotalTime: 121, Count: 10, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 22%
2026-08-02T10:23:06.703 ProcessImageName: ngentask.exe, Pid: 6752, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-08-02T10:23:06.703 ProcessImageName: ngentask.exe, Pid: 4508, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 30%
2026-08-02T10:23:06.703 ProcessImageName: python.exe, Pid: 4068, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\accounts\acme-v02.api.letsencrypt.org\directory\612050855f7c1a31bed06818996045ed\regr.json, EstimatedImpact: 28%
2026-08-02T10:23:06.703 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: taskhostw.exe, Pid: 2248, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 16%
2026-08-02T10:23:06.703 ProcessImageName: notepad.exe, Pid: 5768, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-vhosts.conf, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: notepad.exe, Pid: 8360, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: tzsync.exe, Pid: 4380, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezoneMapping.xml->(UTF-8), EstimatedImpact: 45%
2026-08-02T10:23:06.703 ProcessImageName: DeviceCensus.exe, Pid: 1140, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 7%
2026-08-02T10:23:06.703 ProcessImageName: svchost.exe, Pid: 2972, TotalTime: 61, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator.cdpresource, EstimatedImpact: 1%
2026-08-02T10:23:06.703 ProcessImageName: taskhostw.exe, Pid: 9140, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 4%
2026-08-02T10:23:06.703 ProcessImageName: mysqldump.exe, Pid: 8272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 17%
2026-08-02T10:23:06.703 ProcessImageName: notepad.exe, Pid: 9076, TotalTime: 61, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: python.exe, Pid: 1792, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\.well-known\acme-challenge\web.config, EstimatedImpact: 2%
2026-08-02T10:23:06.703 ProcessImageName: svchost.exe, Pid: 1360, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\prn0037.tmp, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: python.exe, Pid: 8472, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\mamweb.at.conf, EstimatedImpact: 1%
2026-08-02T10:23:06.703 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 7348, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log, EstimatedImpact: 37%
2026-08-02T10:23:06.703 ProcessImageName: powershell.exe, Pid: 5788, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: httpd.exe, Pid: 9132, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Apache24\logs\httpd.pid.iUdTbW, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: cmd.exe, Pid: 3604, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0%
2026-08-02T10:23:06.703 ProcessImageName: powershell.exe, Pid: 8760, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 6%
2026-08-02T10:23:06.703 ProcessImageName: DismHost.exe, Pid: 6036, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{c76cbcad-afc9-11eb-8234-000d3aa6d50e}.TM.blf, EstimatedImpact: 2%
2026-08-02T10:23:06.703 ProcessImageName: python.exe, Pid: 9088, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\web.config, EstimatedImpact: 0%
2026-08-02T10:24:32.391 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T10:32:48.156 Bm signature throttled:0x000032b3547485f1
2026-08-02T10:38:49.406 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:38:49.406 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:38:49.406 [Cloud] Queued cloud request.
2026-08-02T10:38:49.406 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:38:49.406 [Cloud] Dequeued cloud request.
2026-08-02T10:38:49.406 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:38:49.562 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{EE37A4FF-AFC2-2E9A-169F-8C928B60125F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 10:38:49
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T10:38:50.078 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T10:39:20.234 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:39:20.234 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:39:20.234 [Cloud] Queued cloud request.
2026-08-02T10:39:20.234 [Cloud] Dequeued cloud request.
2026-08-02T10:39:20.234 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:39:20.437 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:39:20.750 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{BBF635D3-57E7-4AF3-3F89-C6F4F74D3AD8}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 10:39:20
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T10:39:21.453 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T10:39:37.390 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T10:40:38.375 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:40:38.375 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:40:38.375 [Cloud] Queued cloud request.
2026-08-02T10:40:38.375 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:40:38.375 [Cloud] Dequeued cloud request.
2026-08-02T10:40:38.375 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:40:38.531 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2A99BA6E-59B5-40B7-754A-535A202F81B7}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 10:40:38
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T10:40:39.047 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T10:40:39.547 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:40:39.547 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:40:39.547 [Cloud] Queued cloud request.
2026-08-02T10:40:39.547 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:40:39.547 [Cloud] Dequeued cloud request.
2026-08-02T10:40:39.547 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:40:39.625 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{7F2C1DAC-C008-33F2-1D55-7627E00BB887}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 10:40:39
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T10:40:40.125 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T10:46:43.531 Bm signature throttled:0x000032b3547485f1
2026-08-02T10:46:53.765 Bm signature throttled:0x000032b3547485f1
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=2, resourceid=0x44cfd867
2026-08-02T10:52:04.687 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:52:04.687 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:52:04.687 [Cloud] Queued cloud request.
2026-08-02T10:52:04.687 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:52:04.687 [Cloud] Dequeued cloud request.
2026-08-02T10:52:04.687 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:52:04.781 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Admin\ARPDev.Core.Helper.dll. status=0x40070000, statusex=0x200300, threatid=0x80000000, sigseq=0xb540963e4c6e
2026-08-02T10:52:04.781 [Cloud] End of cloud request.
2026-08-02T10:52:05.296 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T10:54:42.390 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T10:55:10.515 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:55:10.515 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:55:10.515 [Cloud] Queued cloud request.
2026-08-02T10:55:10.515 [Cloud] Dequeued cloud request.
2026-08-02T10:55:10.515 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:55:10.515 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{AE75DFF7-CF30-0C77-A247-D6E0E6F349AB}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 10:55:10
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T10:55:10.702 [Cloud] End of cloud request.
2026-08-02T10:55:11.202 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x5ccd1a78
2026-08-02T10:55:40.280 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:55:40.280 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:55:40.280 [Cloud] Queued cloud request.
2026-08-02T10:55:40.280 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:55:40.280 [Cloud] Dequeued cloud request.
2026-08-02T10:55:40.280 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:55:40.531 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\2d658efba9f306c4e3dd8e7fa695b21232f9a3b9
Dynamic Signature Compilation Timestamp:08-02-2026 10:55:40
Persistence Type:Duration
Time remaining:50065408
2026-08-02T10:55:40.531 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T10:55:40.531 [Cloud] End of cloud request.
2026-08-02T10:55:41.046 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xb192214e
2026-08-02T10:55:42.530 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:55:42.530 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:55:42.530 [Cloud] Queued cloud request.
2026-08-02T10:55:42.530 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:55:42.530 [Cloud] Dequeued cloud request.
2026-08-02T10:55:42.530 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:55:43.030 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\48c1aea494f18769139c0a39bc2da7d0329ad644
Dynamic Signature Compilation Timestamp:08-02-2026 10:55:43
Persistence Type:Duration
Time remaining:150196224
2026-08-02T10:55:43.030 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T10:55:43.030 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x3d40f561
2026-08-02T10:55:43.515 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:55:43.515 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:55:43.515 [Cloud] Queued cloud request.
2026-08-02T10:55:43.515 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:55:43.515 [Cloud] Dequeued cloud request.
2026-08-02T10:55:43.515 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:55:43.546 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T10:55:43.624 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\02047c87e0ae0e5c3d3f9c090820c28c35373743
Dynamic Signature Compilation Timestamp:08-02-2026 10:55:43
Persistence Type:Duration
Time remaining:50065408
2026-08-02T10:55:43.624 [Cloud] End of cloud request.
2026-08-02T10:55:43.624 RTSD:RTSD recieved, rescanning impacted resources
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x98610fb4
2026-08-02T10:55:43.952 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:55:43.952 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:55:43.952 [Cloud] Queued cloud request.
2026-08-02T10:55:43.952 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:55:43.952 [Cloud] Dequeued cloud request.
2026-08-02T10:55:43.952 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\14d34f48ff9b94725bd6571af48e51a6a97a5ada
Dynamic Signature Compilation Timestamp:08-02-2026 10:55:44
Persistence Type:Duration
Time remaining:50065408
2026-08-02T10:55:44.077 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T10:55:44.077 Dynamic signature received
2026-08-02T10:55:44.077 [Cloud] End of cloud request.
2026-08-02T10:55:44.140 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x487b9c7b
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x590ff650
2026-08-02T10:55:45.562 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:55:45.562 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:55:45.562 [Cloud] Queued cloud request.
2026-08-02T10:55:45.562 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:55:45.562 [Cloud] Dequeued cloud request.
2026-08-02T10:55:45.562 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:55:45.734 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\5eca57b9e36dff9b29f1757950e5e549cbc39b0a
Dynamic Signature Compilation Timestamp:08-02-2026 10:55:45
Persistence Type:Duration
Time remaining:50065408
2026-08-02T10:55:45.734 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T10:55:45.734 [Cloud] End of cloud request.
2026-08-02T10:55:46.234 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xe9f724d8
2026-08-02T10:55:47.780 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:55:47.780 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:55:47.780 [Cloud] Queued cloud request.
2026-08-02T10:55:47.780 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:55:47.780 [Cloud] Dequeued cloud request.
2026-08-02T10:55:47.780 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:55:48.062 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\b1e57087943fc8bd7c42d6c69da75df8d66db08f
Dynamic Signature Compilation Timestamp:08-02-2026 10:55:48
Persistence Type:Duration
Time remaining:150196224
2026-08-02T10:55:48.062 [Cloud] End of cloud request.
2026-08-02T10:55:48.062 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T10:55:48.562 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x899f8384
2026-08-02T10:55:48.905 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T10:55:48.905 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T10:55:48.905 [Cloud] Queued cloud request.
2026-08-02T10:55:48.905 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T10:55:48.905 [Cloud] Dequeued cloud request.
2026-08-02T10:55:48.905 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T10:55:49.343 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\8c4e3cd67344bff75f14ac809eeead11fc9fb5a4
Dynamic Signature Compilation Timestamp:08-02-2026 10:55:49
Persistence Type:Duration
Time remaining:150196224
2026-08-02T10:55:49.343 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T10:55:49.343 [Cloud] End of cloud request.
2026-08-02T10:55:49.843 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T11:01:28.546 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T11:01:28.546 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T11:01:28.546 [Cloud] Queued cloud request.
2026-08-02T11:01:28.546 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T11:01:28.546 [Cloud] Dequeued cloud request.
2026-08-02T11:01:28.546 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T11:01:28.687 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{02323E6E-1D9D-A16D-7BC0-ECE698811FDB}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 11:01:28
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T11:01:29.202 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xa385e883
2026-08-02T11:02:05.405 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T11:02:05.405 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T11:02:05.405 [Cloud] Queued cloud request.
2026-08-02T11:02:05.405 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T11:02:05.405 [Cloud] Dequeued cloud request.
2026-08-02T11:02:05.405 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\2f30ec64f3d40115453dfeb61fd1946d588b2eb4
Dynamic Signature Compilation Timestamp:08-02-2026 11:02:05
Persistence Type:Duration
Time remaining:50065408
2026-08-02T11:02:05.624 Dynamic signature received
2026-08-02T11:02:05.624 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T11:02:05.640 [Cloud] End of cloud request.
2026-08-02T11:02:06.140 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xa7e4a7cf
2026-08-02T11:07:30.483 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T11:07:30.483 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T11:07:30.483 [Cloud] Queued cloud request.
2026-08-02T11:07:30.483 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T11:07:30.483 [Cloud] Dequeued cloud request.
2026-08-02T11:07:30.483 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T11:07:31.015 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\439aeb79e3d32c820dc4f6e147b547ffa7c7ed3f
Dynamic Signature Compilation Timestamp:08-02-2026 11:07:31
Persistence Type:Duration
Time remaining:50065408
2026-08-02T11:07:31.015 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T11:07:31.015 [Cloud] End of cloud request.
2026-08-02T11:07:31.530 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x47ec1452
2026-08-02T11:09:47.390 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x16f54ab4
2026-08-02T11:20:33.452 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T11:20:33.452 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T11:20:33.452 [Cloud] Queued cloud request.
2026-08-02T11:20:33.452 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T11:20:33.452 [Cloud] Dequeued cloud request.
2026-08-02T11:20:33.452 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T11:20:33.608 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{CCE8191B-B959-8CB3-BC5B-17A869512AE8}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 11:20:33
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T11:20:34.124 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T11:24:52.389 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x74c8205c
2026-08-02T11:32:17.842 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T11:32:17.842 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T11:32:17.842 [Cloud] Queued cloud request.
2026-08-02T11:32:17.842 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T11:32:17.842 [Cloud] Dequeued cloud request.
2026-08-02T11:32:17.842 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T11:32:18.170 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\18f8ad57bc28f7546de95d18834bb6c54518b073
Dynamic Signature Compilation Timestamp:08-02-2026 11:32:18
Persistence Type:Duration
Time remaining:50065408
2026-08-02T11:32:18.186 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T11:32:18.186 [Cloud] End of cloud request.
2026-08-02T11:32:18.686 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T11:39:46.764 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T11:39:46.764 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T11:39:46.764 [Cloud] Queued cloud request.
2026-08-02T11:39:46.764 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T11:39:46.920 [Cloud] Dequeued cloud request.
2026-08-02T11:39:46.920 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T11:39:47.108 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{CE5F5D86-85F2-F338-1061-99B4B884F4F4}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 11:39:47
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T11:39:47.608 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T11:39:48.311 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T11:39:48.311 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T11:39:48.311 [Cloud] Queued cloud request.
2026-08-02T11:39:48.311 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T11:39:48.311 [Cloud] Dequeued cloud request.
2026-08-02T11:39:48.311 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T11:39:48.405 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E261E40B-34F3-05C2-AEBE-495B8F8BFAB1}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 11:39:48
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T11:39:48.905 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T11:39:57.389 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x8d3de76d
2026-08-02T11:42:54.295 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T11:42:54.295 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T11:42:54.295 [Cloud] Queued cloud request.
2026-08-02T11:42:54.295 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T11:42:54.295 [Cloud] Dequeued cloud request.
2026-08-02T11:42:54.295 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T11:42:54.576 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\010825edaa150ebab2295db6109b6b939a094ede
Dynamic Signature Compilation Timestamp:08-02-2026 11:42:54
Persistence Type:Duration
Time remaining:50065408
2026-08-02T11:42:54.576 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T11:42:54.576 [Cloud] End of cloud request.
2026-08-02T11:42:55.092 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T11:43:08.358 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T11:43:08.358 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T11:43:08.358 [Cloud] Queued cloud request.
2026-08-02T11:43:08.358 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T11:43:08.358 [Cloud] Dequeued cloud request.
2026-08-02T11:43:08.358 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T11:43:08.451 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{010D8046-7CA8-5E4A-36A5-CCB2E08C2E4A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 11:43:08
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T11:43:08.951 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x7e3ff29c
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x611c311b
2026-08-02T11:55:02.389 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x4096c664
2026-08-02T11:55:28.061 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T11:55:28.061 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T11:55:28.061 [Cloud] Queued cloud request.
2026-08-02T11:55:28.061 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T11:55:28.061 [Cloud] Dequeued cloud request.
2026-08-02T11:55:28.061 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T11:55:28.248 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\9feb906533d74a0c0fc89a9f9f9051fc6e9aa482
Dynamic Signature Compilation Timestamp:08-02-2026 11:55:28
Persistence Type:Duration
Time remaining:50065408
2026-08-02T11:55:28.248 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T11:55:28.248 [Cloud] End of cloud request.
2026-08-02T11:55:28.748 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x9aecc656
2026-08-02T11:59:41.936 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T11:59:41.936 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T11:59:41.936 [Cloud] Queued cloud request.
2026-08-02T11:59:41.936 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T11:59:41.936 [Cloud] Dequeued cloud request.
2026-08-02T11:59:41.936 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T11:59:42.576 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\1d326cf29d1debf0988d1be29389fc03bc000c2a
Dynamic Signature Compilation Timestamp:08-02-2026 11:59:42
Persistence Type:Duration
Time remaining:150196224
2026-08-02T11:59:42.576 [Cloud] End of cloud request.
2026-08-02T11:59:42.576 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T11:59:43.076 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x56d96c17
Internal signature match:subtype=Lowfi, sigseq=0x001107BD8A45AAC6, sigsha=5f443c7a99b8ca69580bdc91a5c96c381a4909ba, cached=false, source=2, resourceid=0x56d96c17
2026-08-02T11:59:53.842 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T11:59:53.842 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T11:59:53.842 [Cloud] Queued cloud request.
2026-08-02T11:59:53.842 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T11:59:53.842 [Cloud] Dequeued cloud request.
2026-08-02T11:59:53.857 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{2F66C51D-87B2-E97B-4C8B-0DDE917FDA57}
SignatureID:55745256291477
SigSha:7106c73e392948e275190c3cff85a5401a98a8bc
ThreatLevel:0
ProcessID:4364
ProcessCreationTime:134300926691185095
SessionID:0
CreationTime:08-02-2026 11:59:53
ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T11:59:54.139 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpMyAdmin\tbl_changer.php. status=0x40070000, statusex=0x200200, threatid=0x80000000, sigseq=0x3329faf726b1
2026-08-02T11:59:54.139 [Cloud] End of cloud request.
2026-08-02T11:59:54.639 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T11:59:54.982 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T11:59:54.982 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T11:59:54.982 [Cloud] Queued cloud request.
2026-08-02T11:59:54.982 [Cloud] Dequeued cloud request.
2026-08-02T11:59:54.982 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T11:59:54.982 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T11:59:55.373 [Cloud] End of cloud request.
2026-08-02T11:59:55.889 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T12:02:21.029 [RTP] [Mini-filter] Unsuccessful scan status(#140): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-1834e-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8737027, FileId: 0x110000000c4d24, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T12:03:58.982 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:03:58.982 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:03:58.982 [Cloud] Queued cloud request.
2026-08-02T12:03:58.982 [Cloud] Dequeued cloud request.
2026-08-02T12:03:58.982 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:03:58.982 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:03:59.139 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{91C7B9FF-1921-74FE-ECB1-B09F2B5FB41D}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 12:03:59
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T12:03:59.654 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x8b278ee3
2026-08-02T12:04:46.889 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:04:46.889 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:04:46.889 [Cloud] Queued cloud request.
2026-08-02T12:04:46.889 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:04:46.889 [Cloud] Dequeued cloud request.
2026-08-02T12:04:46.889 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:04:47.311 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\62491b7105e9b5ca172a06290ffd6ea7f79460f6
Dynamic Signature Compilation Timestamp:08-02-2026 12:04:47
Persistence Type:Duration
Time remaining:150196224
2026-08-02T12:04:47.311 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T12:04:47.311 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xb2ae55dc
2026-08-02T12:04:47.826 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T12:04:48.014 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:04:48.014 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:04:48.014 [Cloud] Queued cloud request.
2026-08-02T12:04:48.014 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:04:48.014 [Cloud] Dequeued cloud request.
2026-08-02T12:04:48.014 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:04:48.123 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\225d60608c9ca14f6d99d15ce5a47a5673ee4d8b
Dynamic Signature Compilation Timestamp:08-02-2026 12:04:48
Persistence Type:Duration
Time remaining:50065408
2026-08-02T12:04:48.123 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T12:04:48.154 [Cloud] End of cloud request.
2026-08-02T12:04:48.654 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xfe4e0464
2026-08-02T12:04:49.373 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:04:49.373 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:04:49.373 [Cloud] Queued cloud request.
2026-08-02T12:04:49.373 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:04:49.373 [Cloud] Dequeued cloud request.
2026-08-02T12:04:49.373 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:04:49.482 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\4f06a8cf0813273d924c0d64fd15a9eae3c02222
Dynamic Signature Compilation Timestamp:08-02-2026 12:04:49
Persistence Type:Duration
Time remaining:50065408
2026-08-02T12:04:49.482 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T12:04:49.482 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xe304a036
2026-08-02T12:04:49.873 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:04:49.873 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:04:49.873 [Cloud] Queued cloud request.
2026-08-02T12:04:49.873 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:04:49.873 [Cloud] Dequeued cloud request.
2026-08-02T12:04:49.873 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\52d9e896a86ace9616fff42258097d0ed7afbedc
Dynamic Signature Compilation Timestamp:08-02-2026 12:04:49
Persistence Type:Duration
Time remaining:50065408
2026-08-02T12:04:49.998 Dynamic signature received
2026-08-02T12:04:49.998 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T12:04:49.998 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T12:04:49.998 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xa93009f6
2026-08-02T12:04:50.389 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:04:50.389 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:04:50.389 [Cloud] Queued cloud request.
2026-08-02T12:04:50.389 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:04:50.389 [Cloud] Dequeued cloud request.
2026-08-02T12:04:50.389 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\1cf7ac19e854e9d3851cfcc6cd1b6bdef2812be6
Dynamic Signature Compilation Timestamp:08-02-2026 12:04:50
Persistence Type:Duration
Time remaining:50065408
2026-08-02T12:04:50.514 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T12:04:50.514 Dynamic signature received
2026-08-02T12:04:50.514 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T12:04:50.514 [Cloud] End of cloud request.
2026-08-02T12:04:51.014 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T12:09:12.842 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:09:12.842 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:09:12.842 [Cloud] Queued cloud request.
2026-08-02T12:09:12.842 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:09:12.842 [Cloud] Dequeued cloud request.
2026-08-02T12:09:12.842 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:09:13.014 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{9EA8D051-5D7D-9AAF-C648-DCF202B151DE}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 12:09:13
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T12:09:13.529 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T12:10:07.389 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T12:23:06.701 ProcessImageName: httpd.exe, Pid: 4364, TotalTime: 2112916, Count: 140106, MaxTime: 1546, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 3%
2026-08-02T12:23:06.701 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 21400, Count: 1131, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: AgentShell.exe, Pid: 7480, TotalTime: 15978, Count: 1097, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: httpd.exe, Pid: 4916, TotalTime: 6548, Count: 354, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\googlemaps\Wienerberg_20050613.html->(SCRIPT0002), EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: explorer.exe, Pid: 3232, TotalTime: 5892, Count: 312, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: explorer.exe, Pid: 5148, TotalTime: 2871, Count: 45, MaxTime: 656, MaxTimeFile: \Device\HarddiskVolume2\nginx\nginx.exe, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 2377, Count: 468, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-26f1-0.MAI, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: explorer.exe, Pid: 4500, TotalTime: 2064, Count: 145, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$IAGSLW9.php, EstimatedImpact: 75%
2026-08-02T12:23:06.701 ProcessImageName: powershell.exe, Pid: 9088, TotalTime: 1977, Count: 90, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\000a53285985b0def7f9930691f067ae\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 35%
2026-08-02T12:23:06.701 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1294, Count: 72, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: httpd.exe, Pid: 4344, TotalTime: 1248, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libhttpd.dll, EstimatedImpact: 74%
2026-08-02T12:23:06.701 ProcessImageName: httpd.exe, Pid: 7652, TotalTime: 963, Count: 73, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\sPHDG69Fsq42ArEA9e-xxABuiC5BbJ9i8japwI9iric, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: AgentShellSystemTray.exe, Pid: 2184, TotalTime: 895, Count: 34, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 33%
2026-08-02T12:23:06.701 ProcessImageName: httpd.exe, Pid: 8796, TotalTime: 893, Count: 21, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\PHP53\ext\ioncube_loader_win_5.3.dll, EstimatedImpact: 53%
2026-08-02T12:23:06.701 ProcessImageName: dllhost.exe, Pid: 4576, TotalTime: 744, Count: 54, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: WmiPrvSE.exe, Pid: 7884, TotalTime: 722, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 13%
2026-08-02T12:23:06.701 ProcessImageName: explorer.exe, Pid: 1100, TotalTime: 700, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$I30CG93, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: httpd.exe, Pid: 3452, TotalTime: 635, Count: 13, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php5ts.dll, EstimatedImpact: 96%
2026-08-02T12:23:06.701 ProcessImageName: powershell.exe, Pid: 3424, TotalTime: 634, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\b96f467c2d8ead8ce81b4cdd1f08846e\System.Management.Automation.ni.dll, EstimatedImpact: 20%
2026-08-02T12:23:06.701 ProcessImageName: WmiPrvSE.exe, Pid: 3116, TotalTime: 577, Count: 39, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ci.dll, EstimatedImpact: 42%
2026-08-02T12:23:06.701 ProcessImageName: openssl.exe, Pid: 5900, TotalTime: 562, Count: 3, MaxTime: 406, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libcrypto-3-x64.dll, EstimatedImpact: 100%
2026-08-02T12:23:06.701 ProcessImageName: RuntimeBroker.exe, Pid: 6732, TotalTime: 530, Count: 3, MaxTime: 500, MaxTimeFile: \Device\HarddiskVolume2\Program Files\FileZilla FTP Client\filezilla.exe, EstimatedImpact: 22%
2026-08-02T12:23:06.701 ProcessImageName: httpd.exe, Pid: 7616, TotalTime: 528, Count: 36, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\Rh34zwUdLnkgzypytg777Nd9IcA1vQ6nK6lH7_ze2ag, EstimatedImpact: 9%
2026-08-02T12:23:06.701 ProcessImageName: WmiPrvSE.exe, Pid: 8188, TotalTime: 508, Count: 13, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys, EstimatedImpact: 4%
2026-08-02T12:23:06.701 ProcessImageName: runonce.exe, Pid: 7404, TotalTime: 447, Count: 14, MaxTime: 281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\METray.exe, EstimatedImpact: 30%
2026-08-02T12:23:06.701 ProcessImageName: httpd.exe, Pid: 348, TotalTime: 419, Count: 7, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Apache24\modules\mod_headers.so, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: AgentShellService.exe, Pid: 7152, TotalTime: 354, Count: 25, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Common.Logging.dll, EstimatedImpact: 28%
2026-08-02T12:23:06.701 ProcessImageName: powershell.exe, Pid: 4752, TotalTime: 339, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 36%
2026-08-02T12:23:06.701 ProcessImageName: findstr.exe, Pid: 484, TotalTime: 322, Count: 25, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-autoindex.conf, EstimatedImpact: 89%
2026-08-02T12:23:06.701 ProcessImageName: mmc.exe, Pid: 4572, TotalTime: 308, Count: 16, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\c2f05f765d8b9324d606f711fe96f209\MIGUIControls.ni.dll, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: powershell.exe, Pid: 7356, TotalTime: 294, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\05a4b1b964934d4e32df551575377b5d\System.Management.Automation.ni.dll, EstimatedImpact: 34%
2026-08-02T12:23:06.701 ProcessImageName: WmiPrvSE.exe, Pid: 7432, TotalTime: 294, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100%
2026-08-02T12:23:06.701 ProcessImageName: python.exe, Pid: 2956, TotalTime: 289, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\setuptools-69.0.2.dist-info\entry_points.txt, EstimatedImpact: 13%
2026-08-02T12:23:06.701 ProcessImageName: powershell.exe, Pid: 2944, TotalTime: 276, Count: 28, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\cf430d29074ce2bbf03a1250130d46aa\Microsoft.PowerShell.Commands.Utility.ni.dll, EstimatedImpact: 1%
2026-08-02T12:23:06.701 ProcessImageName: mmc.exe, Pid: 9088, TotalTime: 262, Count: 9, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\KZ3GNUWD\views[1], EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: spoolsv.exe, Pid: 2452, TotalTime: 260, Count: 16, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\spool\V4Dirs\2A69E168-833E-4BE0-9D9D-6E354AC311E8\merged.gpd, EstimatedImpact: 4%
2026-08-02T12:23:06.701 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 258, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: svchost.exe, Pid: 5220, TotalTime: 218, Count: 2, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\DO89A9.tmp, EstimatedImpact: 66%
2026-08-02T12:23:06.701 ProcessImageName: cmd.exe, Pid: 4580, TotalTime: 218, Count: 2, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\OpenSSL.exe, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 185, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: notepad.exe, Pid: 8636, TotalTime: 184, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\httpd.conf, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: httpd.exe, Pid: 3172, TotalTime: 171, Count: 12, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_noframes.html, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: ngentask.exe, Pid: 5804, TotalTime: 136, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 30%
2026-08-02T12:23:06.701 ProcessImageName: python.exe, Pid: 2920, TotalTime: 122, Count: 7, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\certbot\_internal\client.py, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: ngentask.exe, Pid: 700, TotalTime: 121, Count: 10, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log->(UTF-8), EstimatedImpact: 22%
2026-08-02T12:23:06.701 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 121, Count: 9, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: python.exe, Pid: 7888, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 4%
2026-08-02T12:23:06.701 ProcessImageName: ngentask.exe, Pid: 4508, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log, EstimatedImpact: 30%
2026-08-02T12:23:06.701 ProcessImageName: ngentask.exe, Pid: 6752, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log, EstimatedImpact: 32%
2026-08-02T12:23:06.701 ProcessImageName: python.exe, Pid: 4068, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Certbot\accounts\acme-v02.api.letsencrypt.org\directory\612050855f7c1a31bed06818996045ed\regr.json, EstimatedImpact: 28%
2026-08-02T12:23:06.701 ProcessImageName: taskhostw.exe, Pid: 2248, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 16%
2026-08-02T12:23:06.701 ProcessImageName: notepad.exe, Pid: 8360, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: notepad.exe, Pid: 5768, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-vhosts.conf, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: tzsync.exe, Pid: 4380, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezoneMapping.xml->(UTF-8), EstimatedImpact: 45%
2026-08-02T12:23:06.701 ProcessImageName: DeviceCensus.exe, Pid: 1140, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 7%
2026-08-02T12:23:06.701 ProcessImageName: svchost.exe, Pid: 2972, TotalTime: 61, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\L.Administrator.cdpresource, EstimatedImpact: 1%
2026-08-02T12:23:06.701 ProcessImageName: taskhostw.exe, Pid: 9140, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 4%
2026-08-02T12:23:06.701 ProcessImageName: mysqldump.exe, Pid: 8272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 17%
2026-08-02T12:23:06.701 ProcessImageName: notepad.exe, Pid: 9076, TotalTime: 61, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-ssl.conf, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 7348, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log, EstimatedImpact: 37%
2026-08-02T12:23:06.701 ProcessImageName: python.exe, Pid: 1792, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\.well-known\acme-challenge\web.config, EstimatedImpact: 2%
2026-08-02T12:23:06.701 ProcessImageName: svchost.exe, Pid: 1360, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\prn0037.tmp, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: python.exe, Pid: 8472, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\mamweb.at.conf, EstimatedImpact: 1%
2026-08-02T12:23:06.701 ProcessImageName: powershell.exe, Pid: 5788, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: httpd.exe, Pid: 9132, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Apache24\logs\httpd.pid.iUdTbW, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: svchost.exe, Pid: 2192, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: cmd.exe, Pid: 3604, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0%
2026-08-02T12:23:06.701 ProcessImageName: powershell.exe, Pid: 8760, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 6%
2026-08-02T12:23:06.701 ProcessImageName: DismHost.exe, Pid: 6036, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{c76cbcad-afc9-11eb-8234-000d3aa6d50e}.TM.blf, EstimatedImpact: 2%
2026-08-02T12:23:06.701 ProcessImageName: python.exe, Pid: 9088, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\web.config, EstimatedImpact: 0%
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xaccf99db
2026-08-02T12:25:12.388 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=2, resourceid=0x0d014f04
2026-08-02T12:25:14.701 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:25:14.701 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:25:14.701 [Cloud] Queued cloud request.
2026-08-02T12:25:14.701 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:25:14.701 [Cloud] Dequeued cloud request.
2026-08-02T12:25:14.701 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:25:14.857 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Command\ARPDev.Core.Helper.dll. status=0x40070000, statusex=0x200300, threatid=0x80000000, sigseq=0xb540963e4c6e
2026-08-02T12:25:14.857 [Cloud] End of cloud request.
2026-08-02T12:25:15.357 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x82522a8f
2026-08-02T12:30:48.591 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:30:48.591 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:30:48.591 [Cloud] Queued cloud request.
2026-08-02T12:30:48.591 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:30:48.591 [Cloud] Dequeued cloud request.
2026-08-02T12:30:48.591 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:30:49.044 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\a49521e7efe72695e0940b48d631e81d1c617d16
Dynamic Signature Compilation Timestamp:08-02-2026 12:30:49
Persistence Type:Duration
Time remaining:150196224
2026-08-02T12:30:49.044 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T12:30:49.044 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x6b6af12f
2026-08-02T12:30:49.326 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:30:49.326 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:30:49.326 [Cloud] Queued cloud request.
2026-08-02T12:30:49.326 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:30:49.326 [Cloud] Dequeued cloud request.
2026-08-02T12:30:49.326 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:30:49.451 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\632813c7f186fd849cc11f661cdf164127809665
Dynamic Signature Compilation Timestamp:08-02-2026 12:30:49
Persistence Type:Duration
Time remaining:50065408
2026-08-02T12:30:49.451 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T12:30:49.451 [Cloud] End of cloud request.
2026-08-02T12:30:49.544 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x48754ce8
2026-08-02T12:30:50.372 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:30:50.372 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:30:50.372 [Cloud] Queued cloud request.
2026-08-02T12:30:50.372 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:30:50.372 [Cloud] Dequeued cloud request.
2026-08-02T12:30:50.372 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:30:50.763 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\987a855dfcfc1edf39297e1a11ef0c3d8ae1d5d0
Dynamic Signature Compilation Timestamp:08-02-2026 12:30:50
Persistence Type:Duration
Time remaining:150196224
2026-08-02T12:30:50.763 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T12:30:50.763 [Cloud] End of cloud request.
2026-08-02T12:30:51.263 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xe5a931ab
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x73ed95a9
2026-08-02T12:30:56.341 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:30:56.341 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:30:56.341 [Cloud] Queued cloud request.
2026-08-02T12:30:56.341 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:30:56.341 [Cloud] Dequeued cloud request.
2026-08-02T12:30:56.341 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:30:56.451 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\cf87a82d40b308e8a01c03caf040a2e30d768f09
Dynamic Signature Compilation Timestamp:08-02-2026 12:30:56
Persistence Type:Duration
Time remaining:50065408
2026-08-02T12:30:56.451 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T12:30:56.451 [Cloud] End of cloud request.
2026-08-02T12:30:56.951 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x36c1fddf
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x3adb3e81
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd7ad29e6
2026-08-02T12:31:01.388 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:31:01.388 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:31:01.388 [Cloud] Queued cloud request.
2026-08-02T12:31:01.388 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:31:01.388 [Cloud] Dequeued cloud request.
2026-08-02T12:31:01.388 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\7854ddb87a5144f866aa55b944a0b8296f93ff60
Dynamic Signature Compilation Timestamp:08-02-2026 12:31:01
Persistence Type:Duration
Time remaining:50065408
2026-08-02T12:31:01.591 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T12:31:01.607 [Cloud] End of cloud request.
2026-08-02T12:31:01.607 Dynamic signature received
2026-08-02T12:31:02.107 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x691a1b5f
2026-08-02T12:31:02.982 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:31:02.982 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:31:02.982 [Cloud] Queued cloud request.
2026-08-02T12:31:02.982 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:31:02.982 [Cloud] Dequeued cloud request.
2026-08-02T12:31:02.982 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:31:03.107 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\42fdf06f36fe8b13c56744de085099589cd693e9
Dynamic Signature Compilation Timestamp:08-02-2026 12:31:03
Persistence Type:Duration
Time remaining:50065408
2026-08-02T12:31:03.107 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T12:31:03.107 [Cloud] End of cloud request.
2026-08-02T12:31:03.622 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd6ead5e1
2026-08-02T12:31:04.013 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:31:04.013 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:31:04.013 [Cloud] Queued cloud request.
2026-08-02T12:31:04.013 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:31:04.013 [Cloud] Dequeued cloud request.
2026-08-02T12:31:04.013 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:31:04.154 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\43f9184613ff2089f6ef63d212177c4545817110
Dynamic Signature Compilation Timestamp:08-02-2026 12:31:04
Persistence Type:Duration
Time remaining:50065408
2026-08-02T12:31:04.154 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T12:31:04.154 [Cloud] End of cloud request.
2026-08-02T12:31:04.654 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xc8212410
2026-08-02T12:31:05.044 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:31:05.044 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:31:05.044 [Cloud] Queued cloud request.
2026-08-02T12:31:05.044 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:31:05.044 [Cloud] Dequeued cloud request.
2026-08-02T12:31:05.044 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:31:05.451 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\41594c96e1adc91661db1f9dc02c803052559ac3
Dynamic Signature Compilation Timestamp:08-02-2026 12:31:05
Persistence Type:Duration
Time remaining:150196224
2026-08-02T12:31:05.451 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T12:31:05.451 [Cloud] End of cloud request.
2026-08-02T12:31:05.966 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x96850dbb
2026-08-02T12:31:06.779 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:31:06.779 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:31:06.779 [Cloud] Queued cloud request.
2026-08-02T12:31:06.779 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:31:06.779 [Cloud] Dequeued cloud request.
2026-08-02T12:31:06.779 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\7dc1fb0d096ef99807c4b6288ce271de9ca1ff83
Dynamic Signature Compilation Timestamp:08-02-2026 12:31:06
Persistence Type:Duration
Time remaining:50065408
2026-08-02T12:31:06.888 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T12:31:06.888 Dynamic signature received
2026-08-02T12:31:06.904 [Cloud] End of cloud request.
2026-08-02T12:31:07.404 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T12:40:17.388 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T12:48:49.419 [RTP] [Mini-filter] Unsuccessful scan status(#150): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8761026, FileId: 0x80000000c4596, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x077d90eb
Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e
Internal signature match:subtype=Lowfi, sigseq=0x001107BD8A45AAC6, sigsha=5f443c7a99b8ca69580bdc91a5c96c381a4909ba, cached=false, source=2, resourceid=0xd681195e
2026-08-02T12:53:00.700 Bm signature throttled:0x000032b33432fc95
2026-08-02T12:53:00.732 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:53:00.732 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:53:00.732 [Cloud] Queued cloud request.
2026-08-02T12:53:00.732 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:53:00.732 [Cloud] Dequeued cloud request.
2026-08-02T12:53:00.732 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:53:01.278 [Cloud] End of cloud request.
2026-08-02T12:53:01.294 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40070000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c
Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7
2026-08-02T12:53:01.310 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T12:53:01.310 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T12:53:01.310 [Cloud] Queued cloud request.
2026-08-02T12:53:01.310 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T12:53:01.310 [Cloud] Dequeued cloud request.
2026-08-02T12:53:01.310 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T12:53:01.528 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c
2026-08-02T12:53:01.528 [Cloud] End of cloud request.
2026-08-02T12:53:01.810 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T12:55:22.388 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xba36b47b
2026-08-02T13:10:27.387 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x48fd8bdd
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x02e5f7b7
2026-08-02T13:18:39.247 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T13:18:39.247 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T13:18:39.247 [Cloud] Queued cloud request.
2026-08-02T13:18:39.247 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T13:18:39.247 [Cloud] Dequeued cloud request.
2026-08-02T13:18:39.247 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\53095984f845ff54a1071d4b8a7fbcf4a40ee39e
Dynamic Signature Compilation Timestamp:08-02-2026 13:18:39
Persistence Type:Duration
Time remaining:50065408
2026-08-02T13:18:39.559 Dynamic signature received
2026-08-02T13:18:39.559 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T13:18:39.559 [Cloud] End of cloud request.
2026-08-02T13:18:40.075 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T13:25:32.387 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)

BEGIN BM telemetry
GUID:{26B77CAF-1B46-FD89-3E87-D7907C41F064}
SignatureID:340520518878414
SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0
ThreatLevel:0
ProcessID:4364
ProcessCreationTime:134300926691185095
SessionID:0
CreationTime:08-02-2026 13:31:01
ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T13:31:01.934 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T13:31:01.934 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T13:31:01.934 [Cloud] Queued cloud request.
2026-08-02T13:31:01.934 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T13:31:01.934 [Cloud] Dequeued cloud request.
2026-08-02T13:31:01.934 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T13:31:02.059 [Cloud] End of cloud request.
2026-08-02T13:31:02.575 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T13:40:37.387 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x7442b325
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x00d9e675
2026-08-02T13:42:49.309 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T13:42:49.309 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T13:42:49.309 [Cloud] Queued cloud request.
2026-08-02T13:42:49.309 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T13:42:49.309 [Cloud] Dequeued cloud request.
2026-08-02T13:42:49.309 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T13:42:49.496 [Cloud] End of cloud request.
2026-08-02T13:42:49.996 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T13:54:38.262 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T13:54:38.262 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T13:54:38.262 [Cloud] Queued cloud request.
2026-08-02T13:54:38.262 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T13:54:38.262 [Cloud] Dequeued cloud request.
2026-08-02T13:54:38.262 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T13:54:38.465 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{98415204-A1DF-3389-1C63-23D859180B28}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 13:54:38
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T13:54:38.980 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T13:55:34.293 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T13:55:34.293 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T13:55:34.293 [Cloud] Queued cloud request.
2026-08-02T13:55:34.293 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T13:55:34.293 [Cloud] Dequeued cloud request.
2026-08-02T13:55:34.293 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T13:55:34.371 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{283E7FE1-FB88-37EB-0330-A83FD36B4636}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 13:55:34
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T13:55:34.887 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T13:55:42.387 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T14:07:09.902 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T14:07:09.902 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T14:07:09.902 [Cloud] Queued cloud request.
2026-08-02T14:07:09.902 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T14:07:09.902 [Cloud] Dequeued cloud request.
2026-08-02T14:07:09.902 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T14:07:10.074 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{6F26D421-E2A1-89DD-0022-830527AFDB2B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 14:07:10
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T14:07:10.574 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T14:10:47.386 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T14:22:37.386 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3
2026-08-02T14:22:37.433 Job Notification: New process added to job (8040)
2026-08-02T14:22:37.464 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched
2026-08-02T14:22:37.464 Job Notification: New process added to job (1288)
2026-08-02T14:22:37.480 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26060.3008-0\MpCmdRun.exe][Pid:8040] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:1288]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4]
2026-08-02T14:22:37.495 Aggressive catchup quick scan threshold: 489526553481 / 25920000000000
2026-08-02T14:22:37.620 Job Notification: New process added to job (9124)
2026-08-02T14:22:37.636 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched
2026-08-02T14:22:37.636 Job Notification: New process added to job (1924)
2026-08-02T14:22:37.652 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26060.3008-0\MpCmdRun.exe][Pid:9124] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:1924]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4]
2026-08-02T14:22:38.011 [RTP] [RtpConfig] Config change detected, type: 32
2026-08-02T14:22:38.011 [RTP] Duplicating the current plugin configuration object...
2026-08-02T14:22:38.011 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ...
2026-08-02T14:22:38.011 [RTP] Updating plugin configuration due to recent config changes (0x20) ...
2026-08-02T14:22:38.011 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-02T14:22:38.011 [RTP] No config change detected. Not updating plugin configuration.
2026-08-02T14:22:38.011 [RTP] No config changes found. No configuration switch.
2026-08-02T14:22:38.011 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0
2026-08-02T14:22:49.933 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\E848E602-FC83-47FE-AE03-4FA949CCD0DF20b0.1dd228a645b71e8
2026-08-02T14:22:50.011 Verifying engine and signature files (source: 0) ...
2026-08-02T14:22:50.011 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{387B72E8-98FD-4DCE-9447-50BA0F46464E}\mpengine.dll] due to PPL.
2026-08-02T14:22:50.011 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{387B72E8-98FD-4DCE-9447-50BA0F46464E}\mpasbase.vdm]. File not in cache (0x1)
2026-08-02T14:22:51.074 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{387B72E8-98FD-4DCE-9447-50BA0F46464E}\mpasbase.vdm]
2026-08-02T14:22:51.074 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{387B72E8-98FD-4DCE-9447-50BA0F46464E}\mpasdlta.vdm]. File not in cache (0x1)
2026-08-02T14:22:51.089 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{387B72E8-98FD-4DCE-9447-50BA0F46464E}\mpasdlta.vdm]
2026-08-02T14:22:51.089 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{387B72E8-98FD-4DCE-9447-50BA0F46464E}\mpavbase.vdm]. File not in cache (0x1)
2026-08-02T14:22:51.542 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{387B72E8-98FD-4DCE-9447-50BA0F46464E}\mpavbase.vdm]
2026-08-02T14:22:51.542 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{387B72E8-98FD-4DCE-9447-50BA0F46464E}\mpavdlta.vdm]. File not in cache (0x1)
2026-08-02T14:22:51.558 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{387B72E8-98FD-4DCE-9447-50BA0F46464E}\mpavdlta.vdm]
2026-08-02T14:22:51.808 [Engine] IsHybridMode: 0
2026-08-02T14:22:51.808 [KSL]KSL(1.1.26051.3007) Is available via CAMP. KslDevice : KslD
2026-08-02T14:22:51.824 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-552825EBFDB3583939E54C079535EC5716A6566A.bin): 0x00000002
2026-08-02T14:22:51.839 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-552825EBFDB3583939E54C079535EC5716A6566A.bin)
2026-08-02T14:22:51.839 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0
2026-08-02T14:22:51.839 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0
2026-08-02T14:22:51.839 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0
2026-08-02T14:22:51.839 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff
IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b
IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b
IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b
IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b
IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d
IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b
IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d
IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b
2026-08-02T14:23:05.683 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
2026-08-02T14:23:05.683 [AutoExclusion] Applied roles from cache.
2026-08-02T14:23:05.683 [AutoExclusion] Started roles monitoring.
2026-08-02T14:23:05.824 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFA3A7F8AF0, lRefCount: 6, hr=0
2026-08-02T14:23:05.824 [Engine] New active engine 00007FFA391D8AF0 replacing engine 00007FFA3A7F8AF0. Number of active engines: 2
2026-08-02T14:23:05.839 EngineInit:Global ASOC is enabled
2026-08-02T14:23:05.839 EngineInit:ASOO is enabled for developer volumes
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-02T14:23:05.902 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100)
2026-08-02T14:23:05.917 Dynamic signature dropped
Dynamic Signature has been dropped
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\fe1a51e5ca82f2db20c44788490686bc30e6bc73
Dynamic Signature Compilation Timestamp:08-01-2026 21:26:09
Persistence Type:Duration
Time remaining:288000000
2026-08-02T14:23:05.917 Dynamic signature dropped
Dynamic Signature has been dropped
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\a9c1f5dc1252b1f95e1802ee0bc3295c5af92a67
Dynamic Signature Compilation Timestamp:08-01-2026 22:58:04
Persistence Type:Duration
Time remaining:288000000
2026-08-02T14:23:05.949 MpWriteUupSignatureVersion 1.455.470.0, hr = 0
2026-08-02T14:23:05.949 ForceSyncMoacInsertion config from engine is 0, hr = 0x0
2026-08-02T14:23:05.980 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit
2026-08-02T14:23:05.980 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0
2026-08-02T14:23:05.980 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)!
2026-08-02T14:23:05.980 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set.
2026-08-02T14:23:06.011 MpUpdateUpdateResiliencyConfiguration updated to 0
2026-08-02T14:23:06.011 [Plugin] Initializing RTP plugin state...
2026-08-02T14:23:06.011 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off.
2026-08-02T14:23:06.011 [RTP] 
****************************RTP Perf Log***************************
RTP Start:‎08‎-‎01‎-‎2026 16:23:07
Last Perf:‎08‎-‎01‎-‎2026 16:23:06
First RTP Scan:‎08‎-‎01‎-‎2026 16:23:07
Plugin States:  AV:1  AS:1  RTP:1  OA:1  BM:1
Process Exclusions:
Path Exclusions:
Ext Exclusions:
Temp Exclusions:
Worker Threads:
  AM:14
  Async:4
Cache Flushes:
  RTP:1
System File Cache:
  Hits:21629
  Misses:112333
BM Queue:0,3605,0
  Proc:0,1210,0
  File:0,3605,0
Plugin Queue:0,1,0
  Threat:0,0,0
  Susp:0,1,0
  Unknown:0,0,0
  Error:0,0,0
Request Queue:2,3,0
  SetEngine:1,1,0
  SetState:1,1,0
  SetUser:0,1,0
  Config:0,1,0
  ProcExcl:0,1,0
  FilterReload:0,0,0
  FilterUnload:0,0,0
MpFilter:
  Scans:8802983
  Pending:0
  RegSize:309472
  AsyncQNotif:0
  AsyncQMissed:0
  AsyncQTotalSent:-122414986
  AsyncQCurrent:0
  BMFlags:40095
  ServiceMaj:0
  ServiceMin:0
  NumInstance:3
  TotalStreamCon:17876
  NTFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:709406
   TotalHits:7632993
   InstanceCacheInserts:136443
   InstanceCacheUpdates:0
   InstanceCacheDeletes:16633
   InstanceCacheHits:43580
   InstanceCacheMisses:333821
   InstanceCacheOverflows:68038
  CSVFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:0
   TotalHits:0
   InstanceCacheInserts:0
   InstanceCacheUpdates:0
   InstanceCacheDeletes:0
   InstanceCacheHits:0
   InstanceCacheMisses:0
   InstanceCacheOverflows:0
  REFS Cache Statistics (Instance Cache Type:GenericTable):
   TotalMisses:0
   TotalHits:0
   InstanceCacheInserts:0
   InstanceCacheUpdates:0
   InstanceCacheDeletes:0
   InstanceCacheHits:0
   InstanceCacheMisses:0
   InstanceCacheOverflows:0
  SyncProcessCreateDuration:11ms (40026/3514)
   Success: 3514, failures: 0 (last code: 0x0), timeouts: 0,  baddata: 0
 
**************************END RTP Perf Log*************************

 
 

2026-08-02T14:23:06.011 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{387B72E8-98FD-4DCE-9447-50BA0F46464E}
2026-08-02T14:23:06.011 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9EFD095A-7991-4B04-8A83-1BECCAAF06CF}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9EFD095A-7991-4B04-8A83-1BECCAAF06CF}\mpasbase.vdm in use, hr=0x80070020
2026-08-02T14:23:06.011 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0).
2026-08-02T14:23:06.011 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{CA1F1B51-2C7F-426D-A5F1-8555F918DFF0} removed
2026-08-02T14:23:06.011 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f
2026-08-02T14:23:06.011 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f
2026-08-02T14:23:06.011 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f
2026-08-02T14:23:06.011 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f
2026-08-02T14:23:06.011 MdCoreSvc is supported in this platform and OS
Beginning quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Target:
Flags:131074
Start time:08-02-2026 14:23:06
Finished quarantine recovery
Quarantine ID:{00000000-0000-0000-0000-000000000000}
Result:0
End time:08-02-2026 14:23:06
2026-08-02T14:23:06.027 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-02T14:23:06.027 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0
2026-08-02T14:23:06.027 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0).
2026-08-02T14:23:06.027 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0
BmLoggingDisabled:MpDisableBmLogging not set.
2026-08-02T14:23:06.027 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T14:23:06.027 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f
2026-08-02T14:23:06.027 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f
2026-08-02T14:23:06.027 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f
2026-08-02T14:23:06.027 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f
2026-08-02T14:23:06.027 MdCoreSvc is supported in this platform and OS
Signature updated on 08-02-2026 14:23:06
Product Version: 4.18.26060.3008
Service Version: 4.18.26060.3008
Engine Version: 1.1.26060.3008
AS Signature Version: 1.455.470.0
AV Signature Version: 1.455.470.0
************************************************************
2026-08-02T14:23:06.042 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0
2026-08-02T14:23:06.042 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\E848E602-FC83-47FE-AE03-4FA949CCD0DF20b0.1dd228a645b71e8
2026-08-02T14:23:06.089 Process scan (postsignatureupdatescan) started.
2026-08-02T14:23:06.089 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True
2026-08-02T14:23:06.105 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0
Signature updated via MicrosoftUpdateServer on 08-02-2026 14:23:06
************************************************************
2026-08-02T14:23:06.324 Job Notification: Process exited from job (8040)
2026-08-02T14:23:06.324 Job Notification: Process exited from job (1288)
2026-08-02T14:23:06.324 Job Notification: Process exited from job (9124)
2026-08-02T14:23:06.355 Job Notification: Process exited from job (1924)
2026-08-02T14:23:06.464 [KSL] Entering CKSLEngine::EnableKSL. State: [3]
2026-08-02T14:23:06.464 [KSL] CKSLEngine::EnableKSL feature is already enabled.
2026-08-02T14:23:06.464 [KSL] Leaving CKSLEngine::EnableKsl(0).
2026-08-02T14:23:06.480 [RTP] Setting RegLinkHardeningMode to 1 (hr=0).
2026-08-02T14:23:06.480 [RTP] Setting EfsHardeningFlags to 0 (hr=0).
2026-08-02T14:23:06.480 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0).
2026-08-02T14:23:06.480 [RTP] PreventPagingFileAbuseKillbit[0].
2026-08-02T14:23:06.480 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0).
2026-08-02T14:23:06.480 [Engine] Engine 00007FFA3A7F8AF0 no longer in use. Number of active engines: 1
2026-08-02T14:23:06.480 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-02T14:23:06.480 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0).
2026-08-02T14:23:07.136 ProcessImageName: httpd.exe, Pid: 4364, TotalTime: 2360404, Count: 155237, MaxTime: 5187, MaxTimeFile: \Device\HarddiskVolume2\DOWNLOAD\WAMP\wampserver3.3.2_x64.exe, EstimatedImpact: 3%
2026-08-02T14:23:07.136 ProcessImageName: AgentShell.exe, Pid: 3080, TotalTime: 21400, Count: 1131, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-02T14:23:07.136 ProcessImageName: AgentShell.exe, Pid: 7480, TotalTime: 18951, Count: 1293, MaxTime: 328, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0%
2026-08-02T14:23:07.136 ProcessImageName: setup.exe, Pid: 8768, TotalTime: 13383, Count: 562, MaxTime: 4875, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\151.0.4129.59\msedge.dll, EstimatedImpact: 22%
2026-08-02T14:23:07.136 ProcessImageName: httpd.exe, Pid: 4916, TotalTime: 6548, Count: 354, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\googlemaps\Wienerberg_20050613.html->(SCRIPT0002), EstimatedImpact: 0%
2026-08-02T14:23:07.136 ProcessImageName: explorer.exe, Pid: 3232, TotalTime: 5892, Count: 312, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0%
2026-08-02T14:23:07.136 ProcessImageName: explorer.exe, Pid: 5148, TotalTime: 2871, Count: 45, MaxTime: 656, MaxTimeFile: \Device\HarddiskVolume2\nginx\nginx.exe, EstimatedImpact: 0%
2026-08-02T14:23:07.136 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 2437, Count: 474, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-26f1-0.MAI, EstimatedImpact: 0%
2026-08-02T14:23:07.136 ProcessImageName: explorer.exe, Pid: 4500, TotalTime: 2064, Count: 145, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$IAGSLW9.php, EstimatedImpact: 75%
2026-08-02T14:23:07.136 ProcessImageName: powershell.exe, Pid: 9088, TotalTime: 1977, Count: 90, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\000a53285985b0def7f9930691f067ae\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 35%
2026-08-02T14:23:07.136 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 1355, Count: 76, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0%
2026-08-02T14:23:07.136 ProcessImageName: httpd.exe, Pid: 4344, TotalTime: 1248, Count: 27, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Apache24\bin\libhttpd.dll, EstimatedImpact: 74%
2026-08-02T14:23:07.136 ProcessImageName: httpd.exe, Pid: 7652, TotalTime: 963, Count: 73, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\sPHDG69Fsq42ArEA9e-xxABuiC5BbJ9i8japwI9iric, EstimatedImpact: 0%
2026-08-02T14:23:07.136 ProcessImageName: AgentShellSystemTray.exe, Pid: 2184, TotalTime: 895, Count: 34, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 33%
2026-08-02T14:23:07.136 ProcessImageName: httpd.exe, Pid: 8796, TotalTime: 893, Count: 21, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\PHP53\ext\ioncube_loader_win_5.3.dll, EstimatedImpact: 53%
2026-08-02T14:23:07.261 [Engine] RSIG_UNLOADENGINE, 00007FFA3A7F8AF0, err=0x0
2026-08-02T14:23:07.308 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9EFD095A-7991-4B04-8A83-1BECCAAF06CF} removed
2026-08-02T14:23:25.933 Process scan (postsignatureupdatescan) completed.
2026-08-02T14:25:52.386 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T14:28:05.886 [RbM] Setting Last known good engine candidate. hr = 0
Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x4652e614
Internal signature match:subtype=Lowfi, sigseq=0x001107BD8A45AAC6, sigsha=5f443c7a99b8ca69580bdc91a5c96c381a4909ba, cached=false, source=2, resourceid=0x4652e614

BEGIN BM telemetry
GUID:{5FD875C5-B1DE-6BE6-1686-3956564BBBE0}
SignatureID:55745256291477
SigSha:7106c73e392948e275190c3cff85a5401a98a8bc
ThreatLevel:0
ProcessID:4364
ProcessCreationTime:134300926691185095
SessionID:0
CreationTime:08-02-2026 14:30:19
ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T14:30:19.152 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T14:30:19.152 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T14:30:19.152 [Cloud] Queued cloud request.
2026-08-02T14:30:19.152 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T14:30:19.152 [Cloud] Dequeued cloud request.
2026-08-02T14:30:19.152 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T14:30:19.667 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T14:30:19.667 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T14:30:19.667 [Cloud] Queued cloud request.
2026-08-02T14:30:19.667 [Cloud] Dequeued cloud request.
2026-08-02T14:30:19.667 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T14:30:19.667 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T14:30:19.698 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpmyserver\help.php. status=0x40070000, statusex=0x200200, threatid=0x80000000, sigseq=0x3329faf726b1
2026-08-02T14:30:19.698 [Cloud] End of cloud request.
2026-08-02T14:30:20.027 [Cloud] End of cloud request.
2026-08-02T14:30:20.214 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T14:30:28.542 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T14:30:28.542 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T14:30:28.542 [Cloud] Queued cloud request.
2026-08-02T14:30:28.542 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T14:30:28.542 [Cloud] Dequeued cloud request.
2026-08-02T14:30:28.542 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T14:30:28.620 [Cloud] End of cloud request.
2026-08-02T14:30:29.136 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e
Internal signature match:subtype=Lowfi, sigseq=0x001107BD8A45AAC6, sigsha=5f443c7a99b8ca69580bdc91a5c96c381a4909ba, cached=false, source=2, resourceid=0xd681195e

BEGIN BM telemetry
GUID:{9DE2AA16-1C85-AC3A-B050-02AFCBA5EBCE}
SignatureID:55745797457393
SigSha:ddb4adac2aca8c16554162e265921a50721a9574
ThreatLevel:0
ProcessID:4364
ProcessCreationTime:134300926691185095
SessionID:0
CreationTime:08-02-2026 14:34:48
ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T14:34:48.839 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T14:34:48.839 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T14:34:48.839 [Cloud] Queued cloud request.
2026-08-02T14:34:48.839 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T14:34:48.839 [Cloud] Dequeued cloud request.
2026-08-02T14:34:48.839 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T14:34:49.355 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T14:34:49.355 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T14:34:49.355 [Cloud] Queued cloud request.
2026-08-02T14:34:49.355 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T14:34:49.355 [Cloud] Dequeued cloud request.
2026-08-02T14:34:49.355 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T14:34:49.402 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40070000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c
2026-08-02T14:34:49.402 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7
2026-08-02T14:34:49.433 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T14:34:49.433 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T14:34:49.433 [Cloud] Queued cloud request.
2026-08-02T14:34:49.433 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T14:34:49.433 [Cloud] Dequeued cloud request.
2026-08-02T14:34:49.433 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T14:34:49.542 [Cloud] End of cloud request.
2026-08-02T14:34:49.636 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c
2026-08-02T14:34:49.636 [Cloud] End of cloud request.
2026-08-02T14:34:49.902 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T14:35:57.214 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T14:35:57.214 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T14:35:57.214 [Cloud] Queued cloud request.
2026-08-02T14:35:57.214 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T14:35:57.214 [Cloud] Dequeued cloud request.
2026-08-02T14:35:57.214 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T14:35:57.386 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{21471A3B-AC7E-EF2E-C85C-581E0AAFEE7E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 14:35:57
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T14:35:57.886 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T14:37:16.901 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T14:37:16.901 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T14:37:16.901 [Cloud] Queued cloud request.
2026-08-02T14:37:16.901 [Cloud] Dequeued cloud request.
2026-08-02T14:37:16.901 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T14:37:16.901 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T14:37:17.089 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1BE9B345-C38A-0F5C-C5AE-60F502C0EF04}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 14:37:17
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T14:37:17.589 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T14:40:37.667 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T14:40:37.667 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T14:40:37.667 [Cloud] Queued cloud request.
2026-08-02T14:40:37.667 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T14:40:37.667 [Cloud] Dequeued cloud request.
2026-08-02T14:40:37.667 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T14:40:37.933 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E88B546B-C518-47EC-1D00-4EE663699FB0}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 14:40:37
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T14:40:38.433 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T14:40:57.386 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T14:42:32.308 Cache Resizing**********Cache stats************
No. Of buckets -> 25000
Each Bucket has max capacity of -> 1 entries
number of Entries is 24017
Number of invalid entries is 0
Number of inserts issued is 537288
Number of replaces issued is 0
Number of insert failures is 4
Number of inserts with duplicate entries is 3017
Number of lookups is 70993847
Number of lookup misses is 2203786
Number of fast lookup misses is 16007826
Number of false fast lookups is 2203784
Number of invalidations is 372559
Number of maintenance invalidations is 83982
Current File Size is 618496
Journal ID = 1d864ae105a6246
Trusted image state = 4 USN = 1171c7
Setup boot count = 2

2026-08-02T14:42:32.839 [RTP] [RtpConfig] Config change detected, type: 32
2026-08-02T14:42:32.839 [RTP] Duplicating the current plugin configuration object...
2026-08-02T14:42:32.839 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ...
2026-08-02T14:42:32.839 [RTP] Updating plugin configuration due to recent config changes (0x20) ...
2026-08-02T14:42:32.839 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled)
2026-08-02T14:42:32.839 [RTP] No config change detected. Not updating plugin configuration.
2026-08-02T14:42:32.839 [RTP] No config changes found. No configuration switch.
2026-08-02T14:42:32.839 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0

BEGIN BM telemetry
GUID:{D409659E-6936-6710-70B6-50EF26601DE2}
SignatureID:340520518878414
SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0
ThreatLevel:0
ProcessID:4364
ProcessCreationTime:134300926691185095
SessionID:0
CreationTime:08-02-2026 14:50:26
ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T14:50:27.042 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T14:50:27.042 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T14:50:27.042 [Cloud] Queued cloud request.
2026-08-02T14:50:27.042 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T14:50:27.042 [Cloud] Dequeued cloud request.
2026-08-02T14:50:27.042 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T14:50:27.245 [Cloud] End of cloud request.
2026-08-02T14:50:27.760 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T14:52:14.542 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T14:52:14.542 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T14:52:14.542 [Cloud] Queued cloud request.
2026-08-02T14:52:14.542 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T14:52:14.542 [Cloud] Dequeued cloud request.
2026-08-02T14:52:14.542 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T14:52:14.698 [Cloud] End of cloud request.
2026-08-02T14:52:15.214 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T14:56:02.385 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf580bdc8
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x97f6ed24
2026-08-02T15:07:38.260 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:07:38.260 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:07:38.260 [Cloud] Queued cloud request.
2026-08-02T15:07:38.260 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:07:38.260 [Cloud] Dequeued cloud request.
2026-08-02T15:07:38.260 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:07:38.432 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{42305DE5-BEEA-B6FD-3F4C-3F86C62275EF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 15:07:38
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T15:07:38.948 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T15:08:07.026 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:08:07.026 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:08:07.026 [Cloud] Queued cloud request.
2026-08-02T15:08:07.026 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:08:07.026 [Cloud] Dequeued cloud request.
2026-08-02T15:08:07.026 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:08:07.104 [Cloud] End of cloud request.
2026-08-02T15:08:07.620 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T15:11:07.385 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T15:11:14.510 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:11:14.510 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:11:14.510 [Cloud] Queued cloud request.
2026-08-02T15:11:14.510 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:11:14.510 [Cloud] Dequeued cloud request.
2026-08-02T15:11:14.510 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:11:14.651 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{8D9C1B3E-C5AA-C9AF-3DAB-BC4E14F1180F}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 15:11:14
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T15:11:15.151 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T15:14:41.932 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:14:41.932 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:14:41.932 [Cloud] Queued cloud request.
2026-08-02T15:14:41.932 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:14:41.932 [Cloud] Dequeued cloud request.
2026-08-02T15:14:41.932 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:14:42.104 [Cloud] End of cloud request.
2026-08-02T15:14:42.620 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T15:17:22.135 Bm signature throttled:0x000135b39c9104ce
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=2, resourceid=0x44cfd867
2026-08-02T15:19:20.010 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:19:20.010 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:19:20.010 [Cloud] Queued cloud request.
2026-08-02T15:19:20.010 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:19:20.010 [Cloud] Dequeued cloud request.
2026-08-02T15:19:20.026 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:19:20.213 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Admin\ARPDev.Core.Helper.dll. status=0x40070000, statusex=0x200300, threatid=0x80000000, sigseq=0xb540963e4c6e
2026-08-02T15:19:20.213 [Cloud] End of cloud request.
2026-08-02T15:19:20.713 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T15:19:22.213 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:19:22.213 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:19:22.213 [Cloud] Queued cloud request.
2026-08-02T15:19:22.213 [Cloud] Dequeued cloud request.
2026-08-02T15:19:22.213 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:19:22.213 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{4FC5140B-E6A4-1529-43C5-ACED19C02AD9}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 15:19:22
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T15:19:22.291 [Cloud] End of cloud request.
2026-08-02T15:19:22.822 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=2, resourceid=0xdd53ab08
2026-08-02T15:19:28.541 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:19:28.541 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:19:28.541 [Cloud] Queued cloud request.
2026-08-02T15:19:28.541 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:19:28.541 [Cloud] Dequeued cloud request.
2026-08-02T15:19:28.541 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:19:28.572 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Migration\ARPDev.Core.Helper.dll. status=0x40070000, statusex=0x200300, threatid=0x80000000, sigseq=0xb540963e4c6e
2026-08-02T15:19:28.572 [Cloud] End of cloud request.
2026-08-02T15:19:29.088 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=2, resourceid=0x0d014f04
2026-08-02T15:20:31.026 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:20:31.026 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:20:31.026 [Cloud] Queued cloud request.
2026-08-02T15:20:31.026 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:20:31.026 [Cloud] Dequeued cloud request.
2026-08-02T15:20:31.026 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:20:31.182 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Command\ARPDev.Core.Helper.dll. status=0x40070000, statusex=0x200300, threatid=0x80000000, sigseq=0xb540963e4c6e
2026-08-02T15:20:31.182 [Cloud] End of cloud request.
2026-08-02T15:20:31.776 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf139dd04
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x6c363c72
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x9ac9a17f
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd1f998dc
2026-08-02T15:23:29.088 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:23:29.088 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:23:29.088 [Cloud] Queued cloud request.
2026-08-02T15:23:29.088 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:23:29.088 [Cloud] Dequeued cloud request.
2026-08-02T15:23:29.104 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:23:29.276 [Cloud] End of cloud request.
2026-08-02T15:23:29.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T15:23:57.838 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:23:57.838 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:23:57.838 [Cloud] Queued cloud request.
2026-08-02T15:23:57.838 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:23:57.838 [Cloud] Dequeued cloud request.
2026-08-02T15:23:57.854 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:23:58.463 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{7BA871F2-0753-AFD8-7006-447AF0C74F83}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 15:23:58
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T15:23:59.026 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T15:26:12.385 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T15:27:03.307 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:27:03.307 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:27:03.307 [Cloud] Queued cloud request.
2026-08-02T15:27:03.307 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:27:03.307 [Cloud] Dequeued cloud request.
2026-08-02T15:27:03.307 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{F3D5A293-7A76-2864-6686-9EEEBE283716}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 15:27:03
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T15:27:03.541 [Cloud] End of cloud request.
2026-08-02T15:27:04.057 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T15:30:02.197 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:30:02.197 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:30:02.197 [Cloud] Queued cloud request.
2026-08-02T15:30:02.197 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:30:02.197 [Cloud] Dequeued cloud request.
2026-08-02T15:30:02.197 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:30:02.401 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{DC92D6FF-35F2-2420-AB80-29483EFF1C99}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 15:30:02
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T15:30:02.916 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x1b755a3f
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x37d6c11d
2026-08-02T15:30:32.104 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:30:32.104 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:30:32.104 [Cloud] Queued cloud request.
2026-08-02T15:30:32.104 [Cloud] Dequeued cloud request.
2026-08-02T15:30:32.104 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:30:32.104 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:30:32.197 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{6F1E44CF-51A0-F1E4-69BC-88744867602C}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 15:30:32
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T15:30:32.713 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T15:35:08.322 Bm signature throttled:0x000135b39c9104ce
2026-08-02T15:35:49.510 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:35:49.510 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:35:49.510 [Cloud] Queued cloud request.
2026-08-02T15:35:49.510 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:35:49.510 [Cloud] Dequeued cloud request.
2026-08-02T15:35:49.510 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:35:49.697 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{429E8541-3FAC-4550-E308-2D9BBA10BFB8}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 15:35:49
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T15:35:50.213 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T15:36:32.682 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:36:32.682 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:36:32.682 [Cloud] Queued cloud request.
2026-08-02T15:36:32.682 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:36:32.682 [Cloud] Dequeued cloud request.
2026-08-02T15:36:32.682 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:36:32.760 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{F9F1341D-34B0-5506-7F09-5F7664C51661}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 15:36:32
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T15:36:33.260 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T15:41:17.385 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T15:44:54.369 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:44:54.369 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:44:54.369 [Cloud] Queued cloud request.
2026-08-02T15:44:54.369 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:44:54.369 [Cloud] Dequeued cloud request.
2026-08-02T15:44:54.369 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:44:54.541 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{DEE097E6-7807-7096-78D0-DF2D151C6ECF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 15:44:54
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T15:44:55.056 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd34f0fcc
2026-08-02T15:45:34.103 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T15:45:34.103 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T15:45:34.103 [Cloud] Queued cloud request.
2026-08-02T15:45:34.103 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T15:45:34.103 [Cloud] Dequeued cloud request.
2026-08-02T15:45:34.103 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T15:45:34.228 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\71223742b1c1cb451f33ce91e895acda40e38e6a
Dynamic Signature Compilation Timestamp:08-02-2026 15:45:34
Persistence Type:Duration
Time remaining:50065408
2026-08-02T15:45:34.228 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T15:45:34.228 [Cloud] End of cloud request.
2026-08-02T15:45:34.744 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xfc726cf3
2026-08-02T15:56:22.384 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x1c6d0ff2
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x5eda578a
2026-08-02T16:11:27.384 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xe294cdc1
2026-08-02T16:11:51.697 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:11:51.697 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:11:51.697 [Cloud] Queued cloud request.
2026-08-02T16:11:51.697 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:11:51.697 [Cloud] Dequeued cloud request.
2026-08-02T16:11:51.697 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:11:51.931 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\6249a67f9360347c70c73166c49f5e0624dd4c63
Dynamic Signature Compilation Timestamp:08-02-2026 16:11:51
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:11:51.931 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:11:51.931 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x0d27a0df
2026-08-02T16:11:52.181 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:11:52.181 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:11:52.181 [Cloud] Queued cloud request.
2026-08-02T16:11:52.181 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:11:52.181 [Cloud] Dequeued cloud request.
2026-08-02T16:11:52.181 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:11:52.290 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\afa10cf1a8b7b7f7c0dc77d0e617d2274f60c521
Dynamic Signature Compilation Timestamp:08-02-2026 16:11:52
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:11:52.290 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:11:52.290 [Cloud] End of cloud request.
2026-08-02T16:11:52.431 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x1a0bfd05
2026-08-02T16:11:53.290 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:11:53.290 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:11:53.290 [Cloud] Queued cloud request.
2026-08-02T16:11:53.290 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:11:53.290 [Cloud] Dequeued cloud request.
2026-08-02T16:11:53.290 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:11:53.431 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\1a0779b44cd16097b049960b8e5f614950f34bcb
Dynamic Signature Compilation Timestamp:08-02-2026 16:11:53
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:11:53.431 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:11:53.431 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xfddbd6ea
2026-08-02T16:11:53.790 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:11:53.790 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:11:53.790 [Cloud] Queued cloud request.
2026-08-02T16:11:53.790 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:11:53.790 [Cloud] Dequeued cloud request.
2026-08-02T16:11:53.790 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:11:53.931 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T16:11:54.009 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\6eecefaf90b2a579eb562521e52756bf62d020b1
Dynamic Signature Compilation Timestamp:08-02-2026 16:11:53
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:11:54.009 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:11:54.009 [Cloud] End of cloud request.
2026-08-02T16:11:54.509 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xee5887a1
2026-08-02T16:11:54.837 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:11:54.837 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:11:54.837 [Cloud] Queued cloud request.
2026-08-02T16:11:54.837 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:11:54.837 [Cloud] Dequeued cloud request.
2026-08-02T16:11:54.837 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:11:54.931 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\13d04221acce89c90cb887a9f368bae197d1282e
Dynamic Signature Compilation Timestamp:08-02-2026 16:11:54
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:11:54.931 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:11:54.931 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xeb75963b
2026-08-02T16:11:55.400 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:11:55.400 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:11:55.400 [Cloud] Queued cloud request.
2026-08-02T16:11:55.400 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:11:55.400 [Cloud] Dequeued cloud request.
2026-08-02T16:11:55.400 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:11:55.431 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T16:11:55.525 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\894ac0dd8a2e3000cdce0c694c6bca0195bed185
Dynamic Signature Compilation Timestamp:08-02-2026 16:11:55
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:11:55.525 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:11:55.525 [Cloud] End of cloud request.
2026-08-02T16:11:56.025 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xeb79501d
2026-08-02T16:13:42.478 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:13:42.478 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:13:42.478 [Cloud] Queued cloud request.
2026-08-02T16:13:42.478 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:13:42.478 [Cloud] Dequeued cloud request.
2026-08-02T16:13:42.478 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:13:42.665 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{0BC521EB-A60C-D67C-2EC7-4F53C3E1FC9B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 16:13:42
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T16:13:43.165 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x91fd34d8
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x9cdbe4a5
2026-08-02T16:14:58.337 Bm signature throttled:0x000135b39c9104ce
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xe1107258
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x80ce7c90
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x69e7d19f
2026-08-02T16:23:05.821 ProcessImageName: httpd.exe, Pid: 4364, TotalTime: 344269, Count: 17867, MaxTime: 1750, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\MailEnable.Store.dll, EstimatedImpact: 4%
2026-08-02T16:23:05.821 ProcessImageName: AgentShell.exe, Pid: 7480, TotalTime: 2899, Count: 199, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-02T16:23:05.821 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 121, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification->(UTF-16LE), EstimatedImpact: 0%
2026-08-02T16:23:05.821 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemResources\shsvcs.dll.mun, EstimatedImpact: 0%
2026-08-02T16:23:05.821 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 4%
2026-08-02T16:24:00.821 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:24:00.821 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:24:00.821 [Cloud] Queued cloud request.
2026-08-02T16:24:00.821 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:24:00.821 [Cloud] Dequeued cloud request.
2026-08-02T16:24:00.821 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:24:01.025 [Cloud] End of cloud request.
2026-08-02T16:24:01.540 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T16:26:32.384 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T16:28:31.665 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:28:31.665 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:28:31.665 [Cloud] Queued cloud request.
2026-08-02T16:28:31.665 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:28:31.665 [Cloud] Dequeued cloud request.
2026-08-02T16:28:31.665 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{3D6F6C86-46FE-D7B3-FAAD-44FE1C45D59E}
SignatureID:55744863128705
SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 16:28:35
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T16:28:35.868 [Cloud] End of cloud request.
2026-08-02T16:28:36.384 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T16:31:36.602 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:31:36.602 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:31:36.602 [Cloud] Queued cloud request.
2026-08-02T16:31:36.602 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:31:36.602 [Cloud] Dequeued cloud request.
2026-08-02T16:31:36.602 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:31:36.790 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{E4C07075-F73F-830A-70F4-4E12803D3C30}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 16:31:36
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T16:31:37.290 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T16:36:54.915 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:36:54.915 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:36:54.915 [Cloud] Queued cloud request.
2026-08-02T16:36:54.915 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:36:54.915 [Cloud] Dequeued cloud request.
2026-08-02T16:36:54.915 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:36:55.102 [Cloud] End of cloud request.
2026-08-02T16:36:55.618 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T16:37:15.243 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:37:15.243 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:37:15.243 [Cloud] Queued cloud request.
2026-08-02T16:37:15.243 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:37:15.243 [Cloud] Dequeued cloud request.
2026-08-02T16:37:15.243 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:37:15.337 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{2B283F97-F6C2-0C2D-A807-99AB786E8FD0}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 16:37:15
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T16:37:15.852 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T16:37:52.337 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:37:52.337 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:37:52.337 [Cloud] Queued cloud request.
2026-08-02T16:37:52.337 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:37:52.337 [Cloud] Dequeued cloud request.
2026-08-02T16:37:52.337 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:37:52.415 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{0E21408E-3F66-E3CE-CCCA-73C1BD04C683}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 16:37:52
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T16:37:52.915 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T16:39:25.805 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:39:25.805 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:39:25.805 [Cloud] Queued cloud request.
2026-08-02T16:39:25.805 [Cloud] Dequeued cloud request.
2026-08-02T16:39:25.805 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:39:25.805 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:39:26.008 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{1B401122-66C2-F785-7F08-517704333DAA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 16:39:26
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T16:39:26.508 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xa736d491
2026-08-02T16:40:18.212 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:40:18.212 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:40:18.212 [Cloud] Queued cloud request.
2026-08-02T16:40:18.212 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:40:18.212 [Cloud] Dequeued cloud request.
2026-08-02T16:40:18.290 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:40:18.446 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\17782b41a7623149b46d7e1d590c0e6481ebe9f7
Dynamic Signature Compilation Timestamp:08-02-2026 16:40:18
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:40:18.462 [Cloud] End of cloud request.
2026-08-02T16:40:18.462 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:40:18.962 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x79f8a295
2026-08-02T16:40:44.946 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:40:44.946 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:40:44.946 [Cloud] Queued cloud request.
2026-08-02T16:40:44.946 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:40:44.946 [Cloud] Dequeued cloud request.
2026-08-02T16:40:44.946 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:40:45.118 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\41c26cd86f8d01f234b6208d8ebf82cff8f5a088
Dynamic Signature Compilation Timestamp:08-02-2026 16:40:45
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:40:45.118 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:40:45.118 [Cloud] End of cloud request.
2026-08-02T16:40:45.618 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T16:41:37.384 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x4bef1bcf
2026-08-02T16:41:43.446 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:41:43.446 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:41:43.446 [Cloud] Queued cloud request.
2026-08-02T16:41:43.446 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:41:43.446 [Cloud] Dequeued cloud request.
2026-08-02T16:41:43.446 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\af715dbf72d9dd78bec4cdf4cacd87cc0b4063e5
Dynamic Signature Compilation Timestamp:08-02-2026 16:41:43
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:41:43.649 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:41:43.649 Dynamic signature received
2026-08-02T16:41:43.649 [Cloud] End of cloud request.
2026-08-02T16:41:44.165 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x57feb9c3
2026-08-02T16:41:53.430 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:41:53.430 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:41:53.430 [Cloud] Queued cloud request.
2026-08-02T16:41:53.430 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:41:53.430 [Cloud] Dequeued cloud request.
2026-08-02T16:41:53.430 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\e654394ddcee65aeeda2b0daec2a548751d0a19b
Dynamic Signature Compilation Timestamp:08-02-2026 16:41:53
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:41:53.633 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:41:53.649 Dynamic signature received
2026-08-02T16:41:53.649 [Cloud] End of cloud request.
2026-08-02T16:41:54.149 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x047a5478
2026-08-02T16:42:07.227 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:42:07.227 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:42:07.227 [Cloud] Queued cloud request.
2026-08-02T16:42:07.227 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:42:07.227 [Cloud] Dequeued cloud request.
2026-08-02T16:42:07.227 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\1926244aa38bc7a19f78cf939b12ad24b4c23f8b
Dynamic Signature Compilation Timestamp:08-02-2026 16:42:07
Persistence Type:Duration
Time remaining:1728000000
2026-08-02T16:42:07.352 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:42:07.352 [Cloud] End of cloud request.
2026-08-02T16:42:07.352 Dynamic signature received
2026-08-02T16:42:07.868 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x631e274a
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf6ca40dd
2026-08-02T16:42:28.758 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:42:28.758 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:42:28.758 [Cloud] Queued cloud request.
2026-08-02T16:42:28.758 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:42:28.758 [Cloud] Dequeued cloud request.
2026-08-02T16:42:28.758 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:42:28.868 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\7e67c0a83e43c3c51fddac087eece4def0c55cde
Dynamic Signature Compilation Timestamp:08-02-2026 16:42:28
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:42:28.868 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:42:28.883 [Cloud] End of cloud request.
2026-08-02T16:42:29.384 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xa9fe49ce
2026-08-02T16:42:57.993 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:42:57.993 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:42:57.993 [Cloud] Queued cloud request.
2026-08-02T16:42:57.993 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:42:57.993 [Cloud] Dequeued cloud request.
2026-08-02T16:42:57.993 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\09860f8bcc7d7bd4b55e76438ddfc4fff5e8dbb9
Dynamic Signature Compilation Timestamp:08-02-2026 16:42:58
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:42:58.102 Dynamic signature received
2026-08-02T16:42:58.102 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:42:58.118 [Cloud] End of cloud request.
2026-08-02T16:42:58.618 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x6b5f9781
2026-08-02T16:42:59.446 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:42:59.446 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:42:59.446 [Cloud] Queued cloud request.
2026-08-02T16:42:59.446 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:42:59.446 [Cloud] Dequeued cloud request.
2026-08-02T16:42:59.446 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:42:59.602 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\ec1df043624289c01c621509d6523a4813f8229b
Dynamic Signature Compilation Timestamp:08-02-2026 16:42:59
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:42:59.602 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:42:59.602 [Cloud] End of cloud request.
2026-08-02T16:43:00.118 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x762b5833
2026-08-02T16:43:05.712 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:43:05.712 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:43:05.712 [Cloud] Queued cloud request.
2026-08-02T16:43:05.712 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:43:05.712 [Cloud] Dequeued cloud request.
2026-08-02T16:43:05.712 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:43:05.821 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\b8a4376c5818182c984943f93e139cc61ee99077
Dynamic Signature Compilation Timestamp:08-02-2026 16:43:05
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:43:05.821 [Cloud] End of cloud request.
2026-08-02T16:43:05.821 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:43:06.337 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xbfff08ff
2026-08-02T16:43:29.602 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:43:29.602 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:43:29.602 [Cloud] Queued cloud request.
2026-08-02T16:43:29.602 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:43:29.602 [Cloud] Dequeued cloud request.
2026-08-02T16:43:29.602 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:43:29.774 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\fb3704d2092889d114d23535d43dc287cbc6e0d6
Dynamic Signature Compilation Timestamp:08-02-2026 16:43:29
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:43:29.774 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:43:29.774 [Cloud] End of cloud request.
2026-08-02T16:43:30.274 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x8fe1e8ec
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd7f72959
2026-08-02T16:43:44.415 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:43:44.415 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:43:44.415 [Cloud] Queued cloud request.
2026-08-02T16:43:44.415 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:43:44.415 [Cloud] Dequeued cloud request.
2026-08-02T16:43:44.415 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\acb6f539db77b8c9785321ac37ab9a2f93d3c3f9
Dynamic Signature Compilation Timestamp:08-02-2026 16:43:44
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:43:44.805 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:43:44.805 [Cloud] End of cloud request.
2026-08-02T16:43:44.805 Dynamic signature received
2026-08-02T16:43:45.368 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x392c0c4c
2026-08-02T16:43:53.618 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:43:53.618 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:43:53.618 [Cloud] Queued cloud request.
2026-08-02T16:43:53.618 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:43:53.618 [Cloud] Dequeued cloud request.
2026-08-02T16:43:53.618 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:43:53.883 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\9dc0451ba0721400ca8902cecfe1c6bbd526a701
Dynamic Signature Compilation Timestamp:08-02-2026 16:43:53
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:43:53.883 [Cloud] End of cloud request.
2026-08-02T16:43:53.883 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:43:54.415 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd21cf84d
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x0cc3d93b
2026-08-02T16:44:22.821 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:44:22.821 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:44:22.821 [Cloud] Queued cloud request.
2026-08-02T16:44:22.821 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:44:22.821 [Cloud] Dequeued cloud request.
2026-08-02T16:44:22.821 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\ceadc311688a0a839a1c62af536328846db527ac
Dynamic Signature Compilation Timestamp:08-02-2026 16:44:23
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:44:23.024 Dynamic signature received
2026-08-02T16:44:23.024 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:44:23.024 [Cloud] End of cloud request.
2026-08-02T16:44:23.540 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xb76bf0fa
2026-08-02T16:44:33.508 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:44:33.508 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:44:33.508 [Cloud] Queued cloud request.
2026-08-02T16:44:33.508 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:44:33.508 [Cloud] Dequeued cloud request.
2026-08-02T16:44:33.508 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:44:33.618 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\9a7e0e05b33adefadf152134d4734ddd64c5d136
Dynamic Signature Compilation Timestamp:08-02-2026 16:44:33
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:44:33.618 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:44:33.618 [Cloud] End of cloud request.
2026-08-02T16:44:34.118 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xa9a1386b
2026-08-02T16:44:44.930 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:44:44.930 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:44:44.930 [Cloud] Queued cloud request.
2026-08-02T16:44:44.930 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:44:44.930 [Cloud] Dequeued cloud request.
2026-08-02T16:44:44.930 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:44:45.071 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\9a612dbde7ab634f5d2be2117473f85f0a58a3f6
Dynamic Signature Compilation Timestamp:08-02-2026 16:44:45
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:44:45.071 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:44:45.071 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x0141313d
2026-08-02T16:44:45.368 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:44:45.368 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:44:45.368 [Cloud] Queued cloud request.
2026-08-02T16:44:45.368 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:44:45.368 [Cloud] Dequeued cloud request.
2026-08-02T16:44:45.368 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:44:45.493 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\f2b52662ece10c4a34ee59b07fbe75a65c1d56a9
Dynamic Signature Compilation Timestamp:08-02-2026 16:44:45
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:44:45.493 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:44:45.493 [Cloud] End of cloud request.
2026-08-02T16:44:45.602 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xdc1c7335
2026-08-02T16:44:54.462 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:44:54.462 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:44:54.462 [Cloud] Queued cloud request.
2026-08-02T16:44:54.462 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:44:54.462 [Cloud] Dequeued cloud request.
2026-08-02T16:44:54.462 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\d038aff3c80cf6afbec3d5a00b7ba7def1e51cfa
Dynamic Signature Compilation Timestamp:08-02-2026 16:44:54
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:44:54.571 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:44:54.587 [Cloud] End of cloud request.
2026-08-02T16:44:54.587 Dynamic signature received
2026-08-02T16:44:55.102 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf7bfca96
2026-08-02T16:45:19.680 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:45:19.680 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:45:19.680 [Cloud] Queued cloud request.
2026-08-02T16:45:19.680 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:45:19.680 [Cloud] Dequeued cloud request.
2026-08-02T16:45:19.680 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:45:19.805 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\d2338907f421a2b248afc9200e59f3fcf6cbc039
Dynamic Signature Compilation Timestamp:08-02-2026 16:45:19
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:45:19.805 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:45:19.805 [Cloud] End of cloud request.
2026-08-02T16:45:20.305 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xe323efff
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xe27cc5e1
2026-08-02T16:45:38.899 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:45:38.899 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:45:38.899 [Cloud] Queued cloud request.
2026-08-02T16:45:38.899 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:45:38.899 [Cloud] Dequeued cloud request.
2026-08-02T16:45:38.899 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\08a892f693d06e30ca099bed19a5f34913cba381
Dynamic Signature Compilation Timestamp:08-02-2026 16:45:39
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:45:39.040 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:45:39.040 [Cloud] End of cloud request.
2026-08-02T16:45:39.040 Dynamic signature received
2026-08-02T16:45:39.540 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf200502b
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x7e0ccfd0
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x620b6907
2026-08-02T16:45:59.040 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:45:59.040 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:45:59.040 [Cloud] Queued cloud request.
2026-08-02T16:45:59.040 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:45:59.040 [Cloud] Dequeued cloud request.
2026-08-02T16:45:59.040 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xca33e0d5
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\7ad9de1b64934c0ad9766e7516e8d4f6711df040
Dynamic Signature Compilation Timestamp:08-02-2026 16:45:59
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:45:59.165 Dynamic signature received
2026-08-02T16:45:59.165 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:45:59.165 [Cloud] End of cloud request.
2026-08-02T16:45:59.180 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:45:59.180 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:45:59.180 [Cloud] Queued cloud request.
2026-08-02T16:45:59.180 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:45:59.180 [Cloud] Dequeued cloud request.
2026-08-02T16:45:59.180 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:45:59.337 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\3da188ea0269b427266f83f961b2067ddefc7152
Dynamic Signature Compilation Timestamp:08-02-2026 16:45:59
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:45:59.337 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:45:59.337 [Cloud] End of cloud request.
2026-08-02T16:45:59.665 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd7e7df07
2026-08-02T16:46:02.321 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:46:02.321 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:46:02.321 [Cloud] Queued cloud request.
2026-08-02T16:46:02.321 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:46:02.321 [Cloud] Dequeued cloud request.
2026-08-02T16:46:02.321 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\bc55c4603720a818c11b2d7b0a0a894087a4ba07
Dynamic Signature Compilation Timestamp:08-02-2026 16:46:02
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:46:02.587 Dynamic signature received
2026-08-02T16:46:02.587 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:46:02.587 [Cloud] End of cloud request.
2026-08-02T16:46:03.087 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x6a81091a
2026-08-02T16:46:06.571 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:46:06.571 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:46:06.571 [Cloud] Queued cloud request.
2026-08-02T16:46:06.571 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:46:06.571 [Cloud] Dequeued cloud request.
2026-08-02T16:46:06.571 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xb58308a1
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\d28864ffd2218296e2e7fda55d33ecd54add54b9
Dynamic Signature Compilation Timestamp:08-02-2026 16:46:06
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:46:06.696 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:46:06.696 Dynamic signature received
2026-08-02T16:46:06.696 [Cloud] End of cloud request.
2026-08-02T16:46:07.196 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x7981db68
2026-08-02T16:46:16.587 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:46:16.587 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:46:16.587 [Cloud] Queued cloud request.
2026-08-02T16:46:16.587 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:46:16.587 [Cloud] Dequeued cloud request.
2026-08-02T16:46:16.587 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:46:16.712 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\75b915b7bb96b1be9bdd3cd90b662391d62a615a
Dynamic Signature Compilation Timestamp:08-02-2026 16:46:16
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:46:16.712 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:46:16.712 [Cloud] End of cloud request.
2026-08-02T16:46:17.212 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xfe48b304
2026-08-02T16:46:19.712 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:46:19.712 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:46:19.712 [Cloud] Queued cloud request.
2026-08-02T16:46:19.712 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:46:19.712 [Cloud] Dequeued cloud request.
2026-08-02T16:46:19.712 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:46:19.852 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\1a4021aa433a65caeb1440669d87515a7514fec5
Dynamic Signature Compilation Timestamp:08-02-2026 16:46:19
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:46:19.852 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:46:19.852 [Cloud] End of cloud request.
2026-08-02T16:46:20.352 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xb8dab751
2026-08-02T16:46:27.212 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:46:27.212 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:46:27.212 [Cloud] Queued cloud request.
2026-08-02T16:46:27.212 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:46:27.212 [Cloud] Dequeued cloud request.
2026-08-02T16:46:27.212 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\0702a0c6598e29ca000a761650344aee72a661e3
Dynamic Signature Compilation Timestamp:08-02-2026 16:46:27
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:46:27.337 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:46:27.337 [Cloud] End of cloud request.
2026-08-02T16:46:27.337 Dynamic signature received
2026-08-02T16:46:27.837 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xe8ba2bc9
2026-08-02T16:46:36.602 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:46:36.602 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:46:36.602 [Cloud] Queued cloud request.
2026-08-02T16:46:36.602 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:46:36.602 [Cloud] Dequeued cloud request.
2026-08-02T16:46:36.602 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\23f79234e8b0472dee5eb13f65a7170c1118fa74
Dynamic Signature Compilation Timestamp:08-02-2026 16:46:36
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:46:36.743 Dynamic signature received
2026-08-02T16:46:36.743 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:46:36.743 [Cloud] End of cloud request.
2026-08-02T16:46:37.258 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x3a18e71e
2026-08-02T16:47:05.290 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:47:05.290 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:47:05.290 [Cloud] Queued cloud request.
2026-08-02T16:47:05.290 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:47:05.290 [Cloud] Dequeued cloud request.
2026-08-02T16:47:05.290 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:47:05.415 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\6882ba02604082d2b99f914e63e8a00ac3be4451
Dynamic Signature Compilation Timestamp:08-02-2026 16:47:05
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:47:05.415 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:47:05.415 [Cloud] End of cloud request.
2026-08-02T16:47:05.915 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x98cbf610
2026-08-02T16:47:10.758 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:47:10.758 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:47:10.758 [Cloud] Queued cloud request.
2026-08-02T16:47:10.758 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:47:10.758 [Cloud] Dequeued cloud request.
2026-08-02T16:47:10.758 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\a741e655f61edc11a2377a878d3d33d1547087dd
Dynamic Signature Compilation Timestamp:08-02-2026 16:47:10
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:47:10.899 Dynamic signature received
2026-08-02T16:47:10.899 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:47:10.899 [Cloud] End of cloud request.
2026-08-02T16:47:11.415 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x307696aa
2026-08-02T16:47:14.305 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:47:14.305 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:47:14.305 [Cloud] Queued cloud request.
2026-08-02T16:47:14.305 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:47:14.305 [Cloud] Dequeued cloud request.
2026-08-02T16:47:14.305 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:47:14.415 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\91633efa71437de7d138f93fa17bfaeb59f260e4
Dynamic Signature Compilation Timestamp:08-02-2026 16:47:14
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:47:14.415 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:47:14.415 [Cloud] End of cloud request.
2026-08-02T16:47:14.930 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf2ff5185
2026-08-02T16:48:29.883 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:48:29.883 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:48:29.883 [Cloud] Queued cloud request.
2026-08-02T16:48:29.883 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:48:29.883 [Cloud] Dequeued cloud request.
2026-08-02T16:48:29.883 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\5b3b1600fcf33ad424e706d77d9c54294422502a
Dynamic Signature Compilation Timestamp:08-02-2026 16:48:30
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:48:30.211 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:48:30.227 Dynamic signature received
2026-08-02T16:48:30.227 [Cloud] End of cloud request.
2026-08-02T16:48:30.727 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xbda875ee
2026-08-02T16:48:32.383 Engine:Setting original file name "BM_IsPotentialSideLoad" for "c:\apache24\bin\libxml2.dll", hr=0x0
Internal signature match:subtype=Lowfi, sigseq=0x0006D3BD7CBBB9C8, sigsha=e39312c3efbecd0bf40a661fdf236a11f9813e9e, cached=false, source=2, resourceid=0xbda875ee
2026-08-02T16:48:32.493 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:48:32.493 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:48:32.493 [Cloud] Queued cloud request.
2026-08-02T16:48:32.493 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:48:32.493 [Cloud] Dequeued cloud request.
2026-08-02T16:48:32.493 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\dc4a87cfbc924383bca659074c57aeb3681b06fd
Dynamic Signature Compilation Timestamp:08-02-2026 16:48:32
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:48:32.618 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:48:32.649 Dynamic signature received
2026-08-02T16:48:32.649 [Cloud] End of cloud request.
2026-08-02T16:48:33.149 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf63762bf
2026-08-02T16:48:40.571 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:48:40.571 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:48:40.571 [Cloud] Queued cloud request.
2026-08-02T16:48:40.571 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:48:40.571 [Cloud] Dequeued cloud request.
2026-08-02T16:48:40.571 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:48:40.711 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\486b4b1e09528621bf99ea90991c986655b67059
Dynamic Signature Compilation Timestamp:08-02-2026 16:48:40
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:48:40.711 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:48:40.711 [Cloud] End of cloud request.
2026-08-02T16:48:41.227 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x7b720d6d
2026-08-02T16:49:17.196 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:49:17.196 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:49:17.196 [Cloud] Queued cloud request.
2026-08-02T16:49:17.196 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:49:17.196 [Cloud] Dequeued cloud request.
2026-08-02T16:49:17.196 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:49:17.321 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\0ef7062af77d73914b246a37fd66af6c06f7988c
Dynamic Signature Compilation Timestamp:08-02-2026 16:49:17
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:49:17.321 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:49:17.321 [Cloud] End of cloud request.
2026-08-02T16:49:17.821 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x64d84a4e
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=2, resourceid=0xf2c4b588
2026-08-02T16:51:10.196 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:51:10.196 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:51:10.196 [Cloud] Queued cloud request.
2026-08-02T16:51:10.196 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:51:10.196 [Cloud] Dequeued cloud request.
2026-08-02T16:51:10.196 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:51:10.336 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\NETWebMail\bin\ARPDev.Core.Helper.dll. status=0x40070000, statusex=0x200300, threatid=0x80000000, sigseq=0xb540963e4c6e
2026-08-02T16:51:10.336 [Cloud] End of cloud request.
2026-08-02T16:51:10.836 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x164bca8e
2026-08-02T16:53:52.196 Engine:Setting original file name "BM_IsPotentialSideLoad" for "c:\apache24\bin\libcurl.dll", hr=0x0
Internal signature match:subtype=Lowfi, sigseq=0x0006D3BD7CBBB9C8, sigsha=e39312c3efbecd0bf40a661fdf236a11f9813e9e, cached=false, source=2, resourceid=0x164bca8e
2026-08-02T16:53:52.258 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:53:52.258 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:53:52.258 [Cloud] Queued cloud request.
2026-08-02T16:53:52.258 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:53:52.258 [Cloud] Dequeued cloud request.
2026-08-02T16:53:52.258 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:53:52.555 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\3e9347e4c22a26c6e64805e4e4cc7b3fd8da3916
Dynamic Signature Compilation Timestamp:08-02-2026 16:53:52
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:53:52.555 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:53:52.555 [Cloud] End of cloud request.
2026-08-02T16:53:53.071 [NRI] Successfully updated NIS service with platform settings for enforcement level Log

BEGIN BM telemetry
GUID:{6EE35539-6F2A-371A-264C-48145EB55D13}
SignatureID:340520518878414
SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0
ThreatLevel:0
ProcessID:4364
ProcessCreationTime:134300926691185095
SessionID:0
CreationTime:08-02-2026 16:56:01
ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry


BEGIN BM telemetry
GUID:{DAD022A4-6B49-F45B-CBE8-FEEB587229B4}
SignatureID:55745797457393
SigSha:ddb4adac2aca8c16554162e265921a50721a9574
ThreatLevel:0
ProcessID:9104
ProcessCreationTime:134301633610629948
SessionID:0
CreationTime:08-02-2026 16:56:01
ImagePath:C:\Windows\SysWOW64\cmd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe:4364:1,
Operations:None
END BM telemetry

2026-08-02T16:56:02.164 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:56:02.164 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:56:02.164 [Cloud] Queued cloud request.
2026-08-02T16:56:02.164 [Cloud] Dequeued cloud request.
2026-08-02T16:56:02.164 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:56:02.180 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:56:02.243 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:56:02.243 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:56:02.243 [Cloud] Queued cloud request.
2026-08-02T16:56:02.243 [Cloud] Dequeued cloud request.
2026-08-02T16:56:02.243 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:56:02.243 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T16:56:02.336 [Cloud] End of cloud request.
2026-08-02T16:56:02.852 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T16:56:02.930 Bm signature throttled:0x000032b3547485f1
2026-08-02T16:56:03.946 [Cloud] End of cloud request.
2026-08-02T16:56:04.446 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T16:56:42.383 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x7d1520c5
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x33c61e23
2026-08-02T16:57:57.414 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T16:57:57.414 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T16:57:57.414 [Cloud] Queued cloud request.
2026-08-02T16:57:57.414 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T16:57:57.414 [Cloud] Dequeued cloud request.
2026-08-02T16:57:57.414 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\7e323e8ccfc99a5eaebe42d5bb8877f1bc7366ed
Dynamic Signature Compilation Timestamp:08-02-2026 16:57:57
Persistence Type:Duration
Time remaining:50065408
2026-08-02T16:57:57.711 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T16:57:57.727 Dynamic signature received
2026-08-02T16:57:57.727 [Cloud] End of cloud request.
2026-08-02T16:57:58.227 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x68ca2b22
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x8519bed7
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x6f9f37c0
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x32143008
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x088df807
2026-08-02T17:11:47.383 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T17:13:29.133 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:13:29.133 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:13:29.133 [Cloud] Queued cloud request.
2026-08-02T17:13:29.133 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:13:29.133 [Cloud] Dequeued cloud request.
2026-08-02T17:13:29.133 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:13:29.352 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{FA41EA9E-2351-8091-0081-52F5531E72FA}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 17:13:29
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T17:13:29.852 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xe98484ea
2026-08-02T17:16:01.805 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:16:01.805 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:16:01.805 [Cloud] Queued cloud request.
2026-08-02T17:16:01.805 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:16:01.805 [Cloud] Dequeued cloud request.
2026-08-02T17:16:01.805 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:16:01.992 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{35A98F9B-8614-BE36-9CF2-5F9D6CACFAAF}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 17:16:02
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T17:16:02.492 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x463ca46c
2026-08-02T17:17:41.836 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:17:41.836 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:17:41.836 [Cloud] Queued cloud request.
2026-08-02T17:17:41.836 [Cloud] Dequeued cloud request.
2026-08-02T17:17:41.836 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:17:41.836 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\46e8159a98730b76918c0d52c23c9e341d970126
Dynamic Signature Compilation Timestamp:08-02-2026 17:17:42
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:17:42.086 Dynamic signature received
2026-08-02T17:17:42.086 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:17:42.086 [Cloud] End of cloud request.
2026-08-02T17:17:42.586 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x26691ca9
2026-08-02T17:17:51.101 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:17:51.101 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:17:51.101 [Cloud] Queued cloud request.
2026-08-02T17:17:51.101 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:17:51.101 [Cloud] Dequeued cloud request.
2026-08-02T17:17:51.101 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:17:51.320 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\09dbc9c07cea3209ba11301c585a681aea03c535
Dynamic Signature Compilation Timestamp:08-02-2026 17:17:51
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:17:51.320 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:17:51.336 [Cloud] End of cloud request.
2026-08-02T17:17:51.851 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x4430322d
2026-08-02T17:17:54.742 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:17:54.742 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:17:54.758 [Cloud] Queued cloud request.
2026-08-02T17:17:54.758 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:17:54.758 [Cloud] Dequeued cloud request.
2026-08-02T17:17:54.758 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:17:54.883 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\3fcf3ec1dbb4b984b7c2aaf7eea984e40fe24e0a
Dynamic Signature Compilation Timestamp:08-02-2026 17:17:54
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:17:54.883 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:17:54.883 [Cloud] End of cloud request.
2026-08-02T17:17:55.398 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x8778b1ad
2026-08-02T17:18:44.242 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:18:44.242 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:18:44.242 [Cloud] Queued cloud request.
2026-08-02T17:18:44.242 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:18:44.242 [Cloud] Dequeued cloud request.
2026-08-02T17:18:44.242 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:18:44.445 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\8190b889d23688b844c38e62526a329574c41fa3
Dynamic Signature Compilation Timestamp:08-02-2026 17:18:44
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:18:44.445 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:18:44.445 [Cloud] End of cloud request.
2026-08-02T17:18:44.945 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x9818ed54
2026-08-02T17:18:47.398 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:18:47.398 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:18:47.398 [Cloud] Queued cloud request.
2026-08-02T17:18:47.398 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:18:47.398 [Cloud] Dequeued cloud request.
2026-08-02T17:18:47.398 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:18:47.508 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\542c704e3f11d3be2c8431b0dc6a97759d200fab
Dynamic Signature Compilation Timestamp:08-02-2026 17:18:47
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:18:47.508 [Cloud] End of cloud request.
2026-08-02T17:18:47.508 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:18:48.008 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xf602ce7b
2026-08-02T17:18:50.273 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:18:50.273 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:18:50.273 [Cloud] Queued cloud request.
2026-08-02T17:18:50.273 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:18:50.273 [Cloud] Dequeued cloud request.
2026-08-02T17:18:50.273 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\9df6b05e583069b5cfac7d3b6301b4ad867d4c6a
Dynamic Signature Compilation Timestamp:08-02-2026 17:18:50
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:18:50.398 Dynamic signature received
2026-08-02T17:18:50.414 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:18:50.414 [Cloud] End of cloud request.
2026-08-02T17:18:50.914 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x829d01f9
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xc8f24a92
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xec994ef8
2026-08-02T17:19:37.351 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:19:37.351 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:19:37.351 [Cloud] Queued cloud request.
2026-08-02T17:19:37.351 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:19:37.351 [Cloud] Dequeued cloud request.
2026-08-02T17:19:37.351 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:19:37.508 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\0b59b7ff579d82a25afe12e0ed565c851b9bee36
Dynamic Signature Compilation Timestamp:08-02-2026 17:19:37
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:19:37.508 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:19:37.508 [Cloud] End of cloud request.
2026-08-02T17:19:38.008 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xcfcda4f3
2026-08-02T17:20:13.617 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:20:13.617 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:20:13.617 [Cloud] Queued cloud request.
2026-08-02T17:20:13.617 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:20:13.617 [Cloud] Dequeued cloud request.
2026-08-02T17:20:13.617 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:20:13.898 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\6348fe6b0d4370cac960b03cd6628d6e2a0cc5df
Dynamic Signature Compilation Timestamp:08-02-2026 17:20:13
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:20:13.898 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:20:13.898 [Cloud] End of cloud request.
2026-08-02T17:20:14.414 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xda5b8210
2026-08-02T17:20:14.805 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:20:14.805 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:20:14.805 [Cloud] Queued cloud request.
2026-08-02T17:20:14.805 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:20:14.805 [Cloud] Dequeued cloud request.
2026-08-02T17:20:14.805 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:20:14.898 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\6a621e2f99c35a110044f584512449424e102703
Dynamic Signature Compilation Timestamp:08-02-2026 17:20:14
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:20:14.898 [Cloud] End of cloud request.
2026-08-02T17:20:14.898 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:20:15.414 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x788b8128
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x7c08b53e
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x1115cc79
2026-08-02T17:21:10.914 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:21:10.914 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:21:10.914 [Cloud] Queued cloud request.
2026-08-02T17:21:10.914 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:21:10.914 [Cloud] Dequeued cloud request.
2026-08-02T17:21:10.914 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\f0f57ef46e48a49ade758ff83de391643cb39ec4
Dynamic Signature Compilation Timestamp:08-02-2026 17:21:11
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:21:11.039 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:21:11.039 [Cloud] End of cloud request.
2026-08-02T17:21:11.039 Dynamic signature received
2026-08-02T17:21:11.555 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd082bfd8
2026-08-02T17:21:18.476 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:21:18.476 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:21:18.476 [Cloud] Queued cloud request.
2026-08-02T17:21:18.476 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:21:18.476 [Cloud] Dequeued cloud request.
2026-08-02T17:21:18.476 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:21:18.726 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\7e4d52eae63e138af21dc1345665eb7fed363f62
Dynamic Signature Compilation Timestamp:08-02-2026 17:21:18
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:21:18.726 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:21:18.726 [Cloud] End of cloud request.
2026-08-02T17:21:19.242 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x7ff0b824
2026-08-02T17:21:20.820 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:21:20.820 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:21:20.820 [Cloud] Queued cloud request.
2026-08-02T17:21:20.820 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:21:20.820 [Cloud] Dequeued cloud request.
2026-08-02T17:21:20.820 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\392af7a9abc554e58d27128346e7333d36461291
Dynamic Signature Compilation Timestamp:08-02-2026 17:21:20
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:21:20.930 Dynamic signature received
2026-08-02T17:21:20.930 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:21:20.945 [Cloud] End of cloud request.
2026-08-02T17:21:21.445 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x52b9fb31
2026-08-02T17:21:43.195 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:21:43.195 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:21:43.195 [Cloud] Queued cloud request.
2026-08-02T17:21:43.195 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:21:43.195 [Cloud] Dequeued cloud request.
2026-08-02T17:21:43.211 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:21:43.336 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\c52f8623762a1ba02216064a77b2e4ede32a5cb3
Dynamic Signature Compilation Timestamp:08-02-2026 17:21:43
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:21:43.336 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:21:43.336 [Cloud] End of cloud request.
2026-08-02T17:21:43.836 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x3e720bec
2026-08-02T17:21:49.383 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:21:49.383 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:21:49.383 [Cloud] Queued cloud request.
2026-08-02T17:21:49.383 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:21:49.383 [Cloud] Dequeued cloud request.
2026-08-02T17:21:49.383 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:21:49.586 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\f9e9894167cf3f524d1279d26970ecfb65688225
Dynamic Signature Compilation Timestamp:08-02-2026 17:21:49
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:21:49.586 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:21:49.586 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xe68be64f
2026-08-02T17:21:49.836 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:21:49.836 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:21:49.836 [Cloud] Queued cloud request.
2026-08-02T17:21:49.836 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:21:49.836 [Cloud] Dequeued cloud request.
2026-08-02T17:21:49.836 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\a3686d04efea31ecce90fcc8bff9d5c4952492b6
Dynamic Signature Compilation Timestamp:08-02-2026 17:21:49
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:21:49.961 Dynamic signature received
2026-08-02T17:21:49.961 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:21:49.961 [Cloud] End of cloud request.
2026-08-02T17:21:50.086 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x17b0d074
2026-08-02T17:22:30.320 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:22:30.320 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:22:30.320 [Cloud] Queued cloud request.
2026-08-02T17:22:30.320 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:22:30.320 [Cloud] Dequeued cloud request.
2026-08-02T17:22:30.320 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:22:30.508 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\ebf345c302d3ac65c6d5d069cdc4b0637ddb1498
Dynamic Signature Compilation Timestamp:08-02-2026 17:22:30
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:22:30.508 [Cloud] End of cloud request.
2026-08-02T17:22:30.508 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:22:31.008 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xda254aff
2026-08-02T17:22:33.570 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:22:33.570 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:22:33.570 [Cloud] Queued cloud request.
2026-08-02T17:22:33.570 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:22:33.570 [Cloud] Dequeued cloud request.
2026-08-02T17:22:33.570 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\115847d0e6e56fe3ebf80cf387ae0f3ae74e0bf9
Dynamic Signature Compilation Timestamp:08-02-2026 17:22:33
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:22:33.680 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:22:33.695 [Cloud] End of cloud request.
2026-08-02T17:22:33.695 Dynamic signature received
2026-08-02T17:22:34.195 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x38e20a10
2026-08-02T17:22:53.273 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:22:53.273 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:22:53.273 [Cloud] Queued cloud request.
2026-08-02T17:22:53.273 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:22:53.273 [Cloud] Dequeued cloud request.
2026-08-02T17:22:53.273 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:22:53.398 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\ecd4daac754638a11ee1fee171719f20c27cd0d4
Dynamic Signature Compilation Timestamp:08-02-2026 17:22:53
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:22:53.398 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:22:53.398 [Cloud] End of cloud request.
2026-08-02T17:22:53.914 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x6d3f76b1
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xfa5933fa
2026-08-02T17:23:44.726 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:23:44.726 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:23:44.726 [Cloud] Queued cloud request.
2026-08-02T17:23:44.726 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:23:44.726 [Cloud] Dequeued cloud request.
2026-08-02T17:23:44.726 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:23:44.851 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\8f684b3b885bae355b7911c4bd1f62bed66834e3
Dynamic Signature Compilation Timestamp:08-02-2026 17:23:44
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:23:44.851 [Cloud] End of cloud request.
2026-08-02T17:23:44.851 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:23:45.351 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x08babf8d
2026-08-02T17:24:09.008 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:24:09.008 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:24:09.008 [Cloud] Queued cloud request.
2026-08-02T17:24:09.008 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:24:09.008 [Cloud] Dequeued cloud request.
2026-08-02T17:24:09.023 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\f8de64af015032f51401c5380923acf2600913c1
Dynamic Signature Compilation Timestamp:08-02-2026 17:24:09
Persistence Type:Duration
Time remaining:50065408
2026-08-02T17:24:09.226 Dynamic signature received
2026-08-02T17:24:09.226 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T17:24:09.226 [Cloud] End of cloud request.
2026-08-02T17:24:09.726 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T17:26:52.383 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T17:30:14.258 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-198bd-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8901693, FileId: 0xa0000000c43ec, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T17:30:14.258 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-198bd-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #8901694, FileId: 0xf0000000c3f99, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
2026-08-02T17:31:38.226 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:31:38.226 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:31:38.226 [Cloud] Queued cloud request.
2026-08-02T17:31:38.226 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:31:38.226 [Cloud] Dequeued cloud request.
2026-08-02T17:31:38.226 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{88748915-9281-A677-F8C4-3004CA74EE6E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 17:31:38
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T17:31:38.398 [Cloud] End of cloud request.
2026-08-02T17:31:38.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T17:41:57.382 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T17:42:00.976 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:42:00.976 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:42:00.976 [Cloud] Queued cloud request.
2026-08-02T17:42:00.976 [Cloud] Dequeued cloud request.
2026-08-02T17:42:00.976 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:42:00.976 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:42:01.195 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{8E6E46DF-32DF-C2B6-894F-A1BB10386A82}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 17:42:01
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T17:42:01.695 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T17:48:49.242 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:48:49.242 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:48:49.242 [Cloud] Queued cloud request.
2026-08-02T17:48:49.242 [Cloud] Dequeued cloud request.
2026-08-02T17:48:49.242 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:48:49.242 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:48:49.413 [Cloud] End of cloud request.
2026-08-02T17:48:49.913 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T17:50:30.132 Bm signature throttled:0x000135b39c9104ce
2026-08-02T17:52:34.773 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:52:34.773 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:52:34.773 [Cloud] Queued cloud request.
2026-08-02T17:52:34.773 [Cloud] Dequeued cloud request.
2026-08-02T17:52:34.773 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:52:34.773 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:52:34.960 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{0F8BD7E9-C590-BBC2-EA4F-E87A476A59E0}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 17:52:34
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T17:52:35.460 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T17:53:24.570 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:53:24.570 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:53:24.570 [Cloud] Queued cloud request.
2026-08-02T17:53:24.570 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:53:24.570 [Cloud] Dequeued cloud request.
2026-08-02T17:53:24.570 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{68BDA28A-25ED-FE94-42B1-C752FF17D136}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 17:53:24
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T17:53:24.663 [Cloud] End of cloud request.
2026-08-02T17:53:25.163 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xfe891c2b
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x223fda60
2026-08-02T17:56:46.335 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T17:56:46.335 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T17:56:46.335 [Cloud] Queued cloud request.
2026-08-02T17:56:46.335 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T17:56:46.335 [Cloud] Dequeued cloud request.
2026-08-02T17:56:46.335 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T17:56:56.335 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Apache24\modules\mod_lua.so. status=0x40070000, statusex=0x200110, threatid=0x80000000, sigseq=0x294bdc606b459
2026-08-02T17:56:56.491 [Cloud] End of cloud request.
2026-08-02T17:56:56.991 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T17:57:02.382 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=2, resourceid=0x116ea164
2026-08-02T18:04:47.288 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:04:47.288 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:04:47.288 [Cloud] Queued cloud request.
2026-08-02T18:04:47.288 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:04:47.288 [Cloud] Dequeued cloud request.
2026-08-02T18:04:47.288 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T18:04:47.445 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\NETWebAdmin\bin\ARPDev.Core.Helper.dll. status=0x40070000, statusex=0x200300, threatid=0x80000000, sigseq=0xb540963e4c6e
2026-08-02T18:04:47.445 [Cloud] End of cloud request.
2026-08-02T18:04:47.945 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x673d6b0d
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x65a7f644
2026-08-02T18:05:20.616 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:05:20.616 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:05:20.616 [Cloud] Queued cloud request.
2026-08-02T18:05:20.616 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:05:20.616 [Cloud] Dequeued cloud request.
2026-08-02T18:05:20.616 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\26531a8d45631c92e8468a76f69191f60df3134e
Dynamic Signature Compilation Timestamp:08-02-2026 18:05:20
Persistence Type:Duration
Time remaining:50065408
2026-08-02T18:05:20.726 Dynamic signature received
2026-08-02T18:05:20.726 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T18:05:20.726 [Cloud] End of cloud request.
2026-08-02T18:05:21.226 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xdcd42363
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x816d26c7
2026-08-02T18:05:38.726 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:05:38.726 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:05:38.726 [Cloud] Queued cloud request.
2026-08-02T18:05:38.726 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:05:38.741 [Cloud] Dequeued cloud request.
2026-08-02T18:05:38.741 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\46d7c80e98f3bc4f0950589b0f7a37198c3fa0a7
Dynamic Signature Compilation Timestamp:08-02-2026 18:05:38
Persistence Type:Duration
Time remaining:50065408
2026-08-02T18:05:38.851 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T18:05:38.851 Dynamic signature received
2026-08-02T18:05:38.867 [Cloud] End of cloud request.
2026-08-02T18:05:39.382 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xe6f5f76d
2026-08-02T18:05:41.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:05:41.445 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:05:41.445 [Cloud] Queued cloud request.
2026-08-02T18:05:41.445 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:05:41.445 [Cloud] Dequeued cloud request.
2026-08-02T18:05:41.460 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T18:05:41.570 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\bf2e50efee1e70662a1f686c512b1147a7baa8cc
Dynamic Signature Compilation Timestamp:08-02-2026 18:05:41
Persistence Type:Duration
Time remaining:50065408
2026-08-02T18:05:41.585 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T18:05:41.585 [Cloud] End of cloud request.
2026-08-02T18:05:42.085 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x9c50b653
2026-08-02T18:10:47.679 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:10:47.679 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:10:47.679 [Cloud] Queued cloud request.
2026-08-02T18:10:47.679 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:10:47.679 [Cloud] Dequeued cloud request.
2026-08-02T18:10:47.679 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T18:10:47.944 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\0ea9ef98c5ae6fed27e2a042f3850ae383bcd67c
Dynamic Signature Compilation Timestamp:08-02-2026 18:10:47
Persistence Type:Duration
Time remaining:50065408
2026-08-02T18:10:47.944 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T18:10:47.944 [Cloud] End of cloud request.
2026-08-02T18:10:48.444 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T18:12:07.382 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xa7994e1b
2026-08-02T18:14:24.366 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:14:24.366 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:14:24.366 [Cloud] Queued cloud request.
2026-08-02T18:14:24.366 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:14:24.366 [Cloud] Dequeued cloud request.
2026-08-02T18:14:24.366 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T18:14:24.585 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\9ae3e136abc0889895565c810ffef8c48b497a80
Dynamic Signature Compilation Timestamp:08-02-2026 18:14:24
Persistence Type:Duration
Time remaining:50065408
2026-08-02T18:14:24.585 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T18:14:24.585 [Cloud] End of cloud request.
2026-08-02T18:14:25.101 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x05e2be6d
2026-08-02T18:14:31.694 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:14:31.694 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:14:31.694 [Cloud] Queued cloud request.
2026-08-02T18:14:31.694 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:14:31.694 [Cloud] Dequeued cloud request.
2026-08-02T18:14:31.694 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T18:14:31.819 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\7d61a106c5986dba427c21bff876f9883f7294f6
Dynamic Signature Compilation Timestamp:08-02-2026 18:14:31
Persistence Type:Duration
Time remaining:50065408
2026-08-02T18:14:31.819 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T18:14:31.819 [Cloud] End of cloud request.
2026-08-02T18:14:32.319 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T18:15:40.804 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:15:40.804 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:15:40.804 [Cloud] Queued cloud request.
2026-08-02T18:15:40.804 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:15:40.804 [Cloud] Dequeued cloud request.
2026-08-02T18:15:40.804 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T18:15:40.991 [Cloud] End of cloud request.
2026-08-02T18:15:41.507 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xfe51821f
2026-08-02T18:20:34.288 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:20:34.288 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:20:34.288 [Cloud] Queued cloud request.
2026-08-02T18:20:34.288 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:20:34.288 [Cloud] Dequeued cloud request.
2026-08-02T18:20:34.288 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T18:20:34.522 [Cloud] End of cloud request.
2026-08-02T18:20:35.038 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T18:23:05.835 ProcessImageName: httpd.exe, Pid: 4364, TotalTime: 712659, Count: 37076, MaxTime: 2265, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasbase.lkg, EstimatedImpact: 4%
2026-08-02T18:23:05.835 ProcessImageName: AgentShell.exe, Pid: 7480, TotalTime: 5576, Count: 398, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-02T18:23:05.835 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 121, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification->(UTF-16LE), EstimatedImpact: 0%
2026-08-02T18:23:05.835 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemResources\shsvcs.dll.mun, EstimatedImpact: 0%
2026-08-02T18:23:05.835 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 75, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-08-02T18:23:05.835 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-198a4-0.MAD, EstimatedImpact: 0%
2026-08-02T18:23:05.835 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-08-02T18:27:12.382 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T18:31:39.022 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:31:39.022 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:31:39.022 [Cloud] Queued cloud request.
2026-08-02T18:31:39.022 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:31:39.022 [Cloud] Dequeued cloud request.
2026-08-02T18:31:39.022 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{DA8AC517-A60F-E656-614C-9852195231DC}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 18:31:39
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T18:31:39.194 [Cloud] End of cloud request.
2026-08-02T18:31:39.694 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x028ec367
2026-08-02T18:39:09.788 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:39:09.788 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:39:09.788 [Cloud] Queued cloud request.
2026-08-02T18:39:09.788 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:39:09.788 [Cloud] Dequeued cloud request.
2026-08-02T18:39:09.788 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{CE70DDC6-6652-9D4A-7CD9-E820D340BF0B}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 18:39:09
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T18:39:09.944 [Cloud] End of cloud request.
2026-08-02T18:39:10.444 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T18:39:41.960 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:39:41.960 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:39:41.960 [Cloud] Queued cloud request.
2026-08-02T18:39:41.960 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:39:41.960 [Cloud] Dequeued cloud request.
2026-08-02T18:39:41.960 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T18:39:42.053 [Cloud] End of cloud request.
2026-08-02T18:39:42.553 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T18:41:56.381 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:41:56.381 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:41:56.381 [Cloud] Queued cloud request.
2026-08-02T18:41:56.381 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:41:56.404 [Cloud] Dequeued cloud request.
2026-08-02T18:41:56.772 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{0F9EF5EA-172D-89A8-0348-1BCDBA8027CE}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 18:41:58
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T18:41:58.772 [Cloud] End of cloud request.
2026-08-02T18:41:59.319 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T18:42:17.381 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=2, resourceid=0x4a323537
2026-08-02T18:43:57.616 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:43:57.616 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:43:57.616 [Cloud] Queued cloud request.
2026-08-02T18:43:57.616 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:43:57.616 [Cloud] Dequeued cloud request.
2026-08-02T18:43:57.616 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T18:43:57.694 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\NETProtocol\bin\ARPDev.Core.Helper.dll. status=0x40070000, statusex=0x200300, threatid=0x80000000, sigseq=0xb540963e4c6e
2026-08-02T18:43:57.709 [Cloud] End of cloud request.
2026-08-02T18:43:58.209 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x0000B540963E4C6E, sigsha=38bc8178a26bfe986b16154af85e2c3352e5830d, cached=false, source=2, resourceid=0xf2c4b588
2026-08-02T18:44:00.756 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:44:00.756 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:44:00.756 [Cloud] Queued cloud request.
2026-08-02T18:44:00.756 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:44:00.756 [Cloud] Dequeued cloud request.
2026-08-02T18:44:00.756 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T18:44:00.788 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\NETWebMail\bin\ARPDev.Core.Helper.dll. status=0x40070000, statusex=0x200300, threatid=0x80000000, sigseq=0xb540963e4c6e
2026-08-02T18:44:00.788 [Cloud] End of cloud request.
2026-08-02T18:44:01.288 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T18:44:11.334 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:44:11.334 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:44:11.334 [Cloud] Queued cloud request.
2026-08-02T18:44:11.334 [Cloud] Dequeued cloud request.
2026-08-02T18:44:11.334 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:44:11.334 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{B9287B72-83A8-47EE-23CD-53DCEC8AA846}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 18:44:11
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T18:44:11.428 [Cloud] End of cloud request.
2026-08-02T18:44:11.944 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x6d62f307
2026-08-02T18:44:42.131 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:44:42.131 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:44:42.131 [Cloud] Queued cloud request.
2026-08-02T18:44:42.131 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:44:42.131 [Cloud] Dequeued cloud request.
2026-08-02T18:44:42.162 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\c629749307fd6beb8e7f3783d5af39a8b4dc2d8b
Dynamic Signature Compilation Timestamp:08-02-2026 18:44:42
Persistence Type:Duration
Time remaining:50065408
2026-08-02T18:44:42.444 Dynamic signature received
2026-08-02T18:44:42.444 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T18:44:42.444 [Cloud] End of cloud request.
2026-08-02T18:44:42.959 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T18:49:06.741 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:49:06.741 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:49:06.741 [Cloud] Queued cloud request.
2026-08-02T18:49:06.741 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:49:06.741 [Cloud] Dequeued cloud request.
2026-08-02T18:49:06.741 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T18:49:06.897 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{3B7ECC75-D253-DF81-D322-7EBF7D7F60D4}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 18:49:06
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T18:49:07.397 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T18:55:24.787 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T18:55:24.787 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T18:55:24.787 [Cloud] Queued cloud request.
2026-08-02T18:55:24.787 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T18:55:24.803 [Cloud] Dequeued cloud request.
2026-08-02T18:55:24.803 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{59CC0240-D75E-1D6A-19E5-03068396759A}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 18:55:24
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T18:55:24.959 [Cloud] End of cloud request.
2026-08-02T18:55:25.459 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T18:57:22.381 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T19:02:39.068 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:02:39.068 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:02:39.084 [Cloud] Queued cloud request.
2026-08-02T19:02:39.084 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:02:39.084 [Cloud] Dequeued cloud request.
2026-08-02T19:02:39.084 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T19:02:39.225 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{35C408DF-2958-35AD-6973-7B9915AA1047}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 19:02:39
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T19:02:39.740 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x2b202fe7
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xcc119f6b
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x1ff3f414
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xbab59af7
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x8b2e4835
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x5cf0d140
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x3b9d8110
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x2b76e076
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xa459b6bb
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x4c6f70d8
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x3898db07
2026-08-02T19:08:30.178 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:08:30.178 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:08:30.178 [Cloud] Queued cloud request.
2026-08-02T19:08:30.178 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:08:30.178 [Cloud] Dequeued cloud request.
2026-08-02T19:08:30.178 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T19:08:30.428 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\1f1c18a75c467f5d0527a7a42550d58dad1887d8
Dynamic Signature Compilation Timestamp:08-02-2026 19:08:30
Persistence Type:Duration
Time remaining:50065408
2026-08-02T19:08:30.428 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T19:08:30.443 [Cloud] End of cloud request.
2026-08-02T19:08:30.959 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x1e960a0e
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x50264220
2026-08-02T19:08:36.084 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:08:36.084 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:08:36.084 [Cloud] Queued cloud request.
2026-08-02T19:08:36.084 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:08:36.084 [Cloud] Dequeued cloud request.
2026-08-02T19:08:36.084 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\80ff90a1ee106eb36e01e61ebdf2c78d078d4edd
Dynamic Signature Compilation Timestamp:08-02-2026 19:08:36
Persistence Type:Duration
Time remaining:50065408
2026-08-02T19:08:36.287 Dynamic signature received
2026-08-02T19:08:36.287 [Cloud] End of cloud request.
2026-08-02T19:08:36.287 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T19:08:36.787 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x64bf3a9c
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x998c6370
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x0e112d7e
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xbf3aaf60
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xc0dfa306
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xbb2e2ecb
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xb8b1553b
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xd20c9731
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x3001ab77
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x8b5833c2
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x31ac15f8
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x76bfb786
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xec4f882b
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x8c612e35
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xcc41fbdc
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x10cd800a
2026-08-02T19:12:27.381 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T19:14:26.178 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:14:26.178 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:14:26.178 [Cloud] Queued cloud request.
2026-08-02T19:14:26.178 [Cloud] Dequeued cloud request.
2026-08-02T19:14:26.178 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:14:26.459 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{EC4DB895-A5EC-9C2B-3056-561B89FDF9C6}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 19:14:27
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T19:14:27.068 [Cloud] End of cloud request.
2026-08-02T19:14:27.904 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T19:17:56.615 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:17:56.615 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:17:56.615 [Cloud] Queued cloud request.
2026-08-02T19:17:56.615 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:17:56.615 [Cloud] Dequeued cloud request.
2026-08-02T19:17:56.615 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T19:17:56.803 [Cloud] End of cloud request.
2026-08-02T19:17:57.318 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T19:19:25.162 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:19:25.162 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:19:25.162 [Cloud] Queued cloud request.
2026-08-02T19:19:25.162 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:19:25.162 [Cloud] Dequeued cloud request.
2026-08-02T19:19:25.162 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T19:19:25.349 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{ED0B8626-A9F9-1535-5D72-6E0232BE8A49}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 19:19:25
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T19:19:25.849 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x00001727EB7DE8C7, sigsha=115083f33e9b3434e10dc3900db3aa2bba53de1c, cached=false, source=2, resourceid=0xb02d0f2f
2026-08-02T19:27:23.990 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:27:23.990 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:27:23.990 [Cloud] Queued cloud request.
2026-08-02T19:27:23.990 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:27:23.990 [Cloud] Dequeued cloud request.
2026-08-02T19:27:24.005 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T19:27:24.208 Dynamic signature received
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\1c9a98dc19b08254deef6a1beb022e054c07a64f
Dynamic Signature Compilation Timestamp:08-02-2026 19:27:24
Persistence Type:Duration
Time remaining:150196224
2026-08-02T19:27:24.208 RTSD:RTSD recieved, rescanning impacted resources
2026-08-02T19:27:24.208 [Cloud] End of cloud request.
Internal signature match:subtype=Lowfi, sigseq=0x00000070DE3CA1F0, sigsha=da39a3ee5e6b4b0d3255bfef95601890afd80709, cached=false, source=2, resourceid=0xb02d0f2f
2026-08-02T19:27:24.240 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\prnjobs.vbs. status=0x40030000, statusex=0x200, threatid=0x80000000, sigseq=0x1727eb7de8c7
2026-08-02T19:27:24.724 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T19:27:32.380 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T19:27:44.880 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:27:44.880 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:27:44.880 [Cloud] Queued cloud request.
2026-08-02T19:27:44.880 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:27:44.880 [Cloud] Dequeued cloud request.
2026-08-02T19:27:44.880 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T19:27:45.005 [Cloud] End of cloud request.
2026-08-02T19:27:45.505 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x00001727EB7DE8C7, sigsha=115083f33e9b3434e10dc3900db3aa2bba53de1c, cached=false, source=2, resourceid=0x4c9511ab
2026-08-02T19:29:00.396 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:29:00.396 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:29:00.396 [Cloud] Queued cloud request.
2026-08-02T19:29:00.396 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:29:00.396 [Cloud] Dequeued cloud request.
2026-08-02T19:29:00.396 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\70be6a4e7b5dfcb371991066ae7f34628947d16c
Dynamic Signature Compilation Timestamp:08-02-2026 19:29:00
Persistence Type:Duration
Time remaining:150196224
2026-08-02T19:29:00.677 RTSD:RTSD recieved, rescanning impacted resources
Internal signature match:subtype=Lowfi, sigseq=0x00000070DE3CA1F0, sigsha=da39a3ee5e6b4b0d3255bfef95601890afd80709, cached=false, source=2, resourceid=0x4c9511ab
2026-08-02T19:29:00.724 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\prnjobs.vbs. status=0x40030000, statusex=0x200, threatid=0x80000000, sigseq=0x1727eb7de8c7
2026-08-02T19:29:00.818 Dynamic signature received
2026-08-02T19:29:00.818 [Cloud] End of cloud request.
2026-08-02T19:29:01.318 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T19:38:15.630 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:38:15.630 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:38:15.630 [Cloud] Queued cloud request.
2026-08-02T19:38:15.630 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:38:15.630 [Cloud] Dequeued cloud request.
2026-08-02T19:38:15.708 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{97FF3218-AF27-3019-6A2B-B63D373AB5A7}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 19:38:17
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T19:38:17.208 [Cloud] End of cloud request.
2026-08-02T19:38:19.208 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T19:40:43.693 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:40:43.693 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:40:43.693 [Cloud] Queued cloud request.
2026-08-02T19:40:43.693 [Cloud] Dequeued cloud request.
2026-08-02T19:40:43.693 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:40:43.693 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T19:40:43.927 [Cloud] End of cloud request.
2026-08-02T19:40:44.443 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T19:42:37.380 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T19:43:42.489 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:43:42.489 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:43:42.489 [Cloud] Queued cloud request.
2026-08-02T19:43:42.489 [Cloud] Dequeued cloud request.
2026-08-02T19:43:42.489 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:43:42.489 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T19:43:42.786 [Cloud] End of cloud request.
2026-08-02T19:43:43.427 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T19:50:54.927 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:50:54.927 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:50:54.927 [Cloud] Queued cloud request.
2026-08-02T19:50:54.927 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:50:54.927 [Cloud] Dequeued cloud request.
2026-08-02T19:50:54.942 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T19:50:55.099 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{09D5DDC2-72E8-6067-1BCA-60C5E4C64324}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 19:50:55
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T19:50:55.599 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T19:57:17.911 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:57:17.911 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:57:17.911 [Cloud] Queued cloud request.
2026-08-02T19:57:17.911 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:57:17.911 [Cloud] Dequeued cloud request.
2026-08-02T19:57:17.911 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0

BEGIN BM telemetry
GUID:{6FD2E140-69A9-2099-FF47-F63EB2C05AFE}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 19:57:18
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T19:57:18.114 [Cloud] End of cloud request.
2026-08-02T19:57:18.614 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T19:57:42.380 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0x62fe7fc0
Internal signature match:subtype=Lowfi, sigseq=0x001107BD8A45AAC6, sigsha=5f443c7a99b8ca69580bdc91a5c96c381a4909ba, cached=false, source=2, resourceid=0x62fe7fc0
2026-08-02T19:59:29.161 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:59:29.161 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:59:29.161 [Cloud] Queued cloud request.
2026-08-02T19:59:29.161 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:59:29.161 [Cloud] Dequeued cloud request.

BEGIN BM telemetry
GUID:{610F9FF3-88B2-DCB4-0979-7FAECFA90E1A}
SignatureID:55745256291477
SigSha:7106c73e392948e275190c3cff85a5401a98a8bc
ThreatLevel:0
ProcessID:4364
ProcessCreationTime:134300926691185095
SessionID:0
CreationTime:08-02-2026 19:59:29
ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T19:59:29.348 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T19:59:31.130 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$R30CG93\shell2.php. status=0x40070000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c
Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0x1044fcb3
2026-08-02T19:59:31.145 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:59:31.145 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:59:31.145 [Cloud] Queued cloud request.
2026-08-02T19:59:31.145 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:59:31.349 [Cloud] Dequeued cloud request.
2026-08-02T19:59:31.349 [Cloud] End of cloud request.
2026-08-02T19:59:31.349 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T19:59:32.208 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T19:59:33.005 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$R30CG93\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c
2026-08-02T19:59:33.286 [Cloud] End of cloud request.
2026-08-02T19:59:34.239 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T19:59:36.442 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T19:59:36.442 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T19:59:36.442 [Cloud] Queued cloud request.
2026-08-02T19:59:36.442 [Cloud] Dequeued cloud request.
2026-08-02T19:59:36.442 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T19:59:36.474 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T19:59:37.520 [Cloud] End of cloud request.
2026-08-02T19:59:38.333 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
2026-08-02T20:12:47.380 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T20:13:51.567 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1
2026-08-02T20:13:51.567 [Cloud] Start of cloud request. Passive mode: 0
2026-08-02T20:13:51.567 [Cloud] Queued cloud request.
2026-08-02T20:13:51.567 [Cloud] MpEngineCloudRequest(). hr = 0
2026-08-02T20:13:51.567 [Cloud] Dequeued cloud request.
2026-08-02T20:13:51.567 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0
2026-08-02T20:13:51.708 [Cloud] End of cloud request.

BEGIN BM telemetry
GUID:{60C600E1-A1EB-D518-B4C5-5D7CE7C1DE2E}
SignatureID:55745127179687
SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4
ThreatLevel:0
ProcessID:0
ProcessCreationTime:42949672960
SessionID:4294967295
CreationTime:08-02-2026 20:13:51
Taint Info:Friendly: N; Reason: ; Modules: ; Parents: 
Operations:None
END BM telemetry

2026-08-02T20:13:52.223 [NRI] Successfully updated NIS service with platform settings for enforcement level Log
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x2c7dd59a
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xecc143be
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x85277da6
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0xabf25377
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x35122a24
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x806de207
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x8fc63603
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x316f3d00
Internal signature match:subtype=Lowfi, sigseq=0x000294BDC606B459, sigsha=425fe00cff03a4c1f56b5218212a01b292c0dbf5, cached=false, source=2, resourceid=0x537ca43c
2026-08-02T20:23:05.833 ProcessImageName: httpd.exe, Pid: 4364, TotalTime: 1057731, Count: 55338, MaxTime: 2843, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Bin\NETWebMail\bin\HooDooWebMail.dll, EstimatedImpact: 4%
2026-08-02T20:23:05.833 ProcessImageName: AgentShell.exe, Pid: 7480, TotalTime: 8552, Count: 598, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0%
2026-08-02T20:23:05.833 ProcessImageName: mysqld.exe, Pid: 1964, TotalTime: 137, Count: 12, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-7ac-1a4a7-0.MAI, EstimatedImpact: 0%
2026-08-02T20:23:05.833 ProcessImageName: svchost.exe, Pid: 1808, TotalTime: 121, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification->(UTF-16LE), EstimatedImpact: 0%
2026-08-02T20:23:05.833 ProcessImageName: dllhost.exe, Pid: 4116, TotalTime: 120, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0%
2026-08-02T20:23:05.833 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemResources\shsvcs.dll.mun, EstimatedImpact: 0%
2026-08-02T20:23:05.833 ProcessImageName: MESMTPC.exe, Pid: 2852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0%
2026-08-02T20:27:52.379 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)
2026-08-02T20:42:57.379 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config)